I am assuming the first screenshot is from running

select * from osquery_flags

on a host. Unfortunately, changes to agent options in fleet are not automatically deployed to hosts via orbit yet. You need to generate a new installer and re-install orbit on hosts. However, this will soon change in a future release of fleet! See https://github.com/fleetdm/fleet/issues/6851 and https://github.com/fleetdm/fleet/pull/7246 for more info

Hi fleet team, does /api/osquery/enroll API require cert even i mark tls false on fleet side? ExecStart=/usr/bin/fleet serve \ --mysql_address=127.0.0.1:3306 \ --mysql_database=fleet \ --mysql_username=root \ --mysql_password=admin \ --redis_address=127.0.0.1:6379 \ --redis_password=fleetpass \ --filesystem_enable_log_compression=true \ --filesystem_enable_log_rotation=true \ --filesystem_result_log_file=/var/log/fleet/result.log \ --server_tls=false \

Hi Fleet team, i want to put all my problems in a new thread. our fleet is running in bad state, you can see from the above screenshot the traffic our lb for fleet is pretty high. and fleet server cpu usage

Hey all! I recently deployed FleetDM across endpoints but noticed that around 3-5% of the hosts will not properly fetch after the initial install. Looking into the FleetDM dashboard those 3-5% of hosts also just show "No data available" under the "Disk space available" section of the Hosts tab. Has anyone run into issues where just a small portion of hosts don't properly call in but all the rests do? If so was there any troubleshooting procedures that helped identify the problem? Thanks!

hi fleet team, our fleet has a /var/log/fleet/result.log file storing lots of logging long time ago, could anyone help to explain what is it about?

Hi fleet team, we have a fleet server just set up a new db but we got this err when we start fleet service: Sep 23 235302 n121-011-134 fleet[2423897]: ts=2022-09-23T235302.009530884Z mysql="could not connect to db: dial tcp 127.0.0.13306 connect: connection refused, sleeping 7s" but in our fleet.service cfg file, we had a different db

I am using fleet 4.5.1 when I press on the queries bottom at the web ui my fleet ui get stuck for something like 8 seconds

Anyone who has configure osquery to send results to s3? can we have a call? below is my config and still results are not flowing into aws 😐 config: spec: host_settings: enable_software_inventory: true vulnerability_settings: databases_path: /tmp/ options: host_identifier: hostname schedule_splay_percent: 10 logger_plugin: aws_kinesis,aws_firehose aws_kinesis_stream: fleetosquery**** aws_firehose_stream: fleetosquery*** aws_access_key_id: ********* aws_secret_access_key: ********* aws_region: eu-west-2 disable_carver: false pack_delimiter: / proxy_hostname: ** carver_block_size: 2097152 logger_tls_period: 10 distributed_plugin: tls disable_distributed: false logger_tls_endpoint: /api/osquery/log distributed_interval: 10 carver_start_endpoint: /api/v1/osquery/carve/begin carver_disable_function: false carver_continue_endpoint: /api/v1/osquery/carve/block distributed_tls_max_attempts: 3 schedule: time: query: SELECT * FROM time; interval: 2 removed: false osquery: osquery_result_log_plugin: kinesis osquery_status_log_plugin: kinesis decorators: load: - SELECT uuid AS host_uuid FROM system_info; - SELECT hostname AS hostname FROM system_info; overrides: {}

Hi everyone, I am just wrapping my head around the Orbit installer for the first time. Most things seem to work, but I am not seeing any Windows Event Log activity from osquery, even though my flagfile contains the line

--logger_plugin=windows_event_log

. I am curious if perhaps the issue is that the command line flag from here: https://github.com/fleetdm/fleet/blob/ecd155c16faebb033b3ea52e4cab309b54947220/orbit/pkg/osquery/flags.go is overriding the line in the flagfile. If so, is there a way to configure Orbit to not pass that logger plugin command line argument?

Hey team, not urgent but just want to confirm something before I start to deploy broadly. This documentation is slightly outdated: https://fleetdm.com/docs/using-fleet/adding-hosts#grant-full-disk-access-to-osquery-on-mac-os I’m using fleetctl version 4.18 to generate the installer and it looks like my app path is

/opt/orbit/bin/orbit/macos/stable/orbit

Need to create a PPPC profile profile for MDM so path and code sign needs to be correct across the fleet.

Hi fleet team, we have a fleet server just set up a new db but we got this err when we start fleet service: Sep 23 235302 n121-011-134 fleet[2423897]: ts=2022-09-23T235302.009530884Z mysql="could not connect to db: dial tcp 127.0.0.13306 connect: connection refused, sleeping 7s" but in our fleet.service cfg file, we had a different db

Hi Fleet team, we are suffering a problem that we have 3 nodes in our cluster of fleet behind the lb, and we found one of them has much more http conns than others, and after debug, I saw there are more than 14K http conns in CLOSE_WAIT state. plz advice.

do we have a manual for fleetctl query?

We seem to be having some issues with the distributed query called

fleet_detail_query_software_windows

. In particular, we might be hitting a CPU utilization limit with the Python package listing on some Windows systems. Is there a way to change that query or prevent it from running?

Does anyone know how we could use the Orbit install package with mutual TLS? Right now we can manually drop the client keypair on disk and use the packaged flagfile to provide the path, but ideally we would like to include the keypair in the .msi package so we can use a single clean package install for the entire agent. Right now I just don't see a way to bake the certificate and key files into the .msi using the

fleetctl package

command. Would that be a new feature request or am I missing something?

Hi All, I'm working on a script to populate policies from existing queries, however when I am sending a POST to https://fleet.fqdn.tld/api/v1/fleet/global/policies following this documentation despite setting the "Authorization: Bearer $TOKEN" header, I keep seeing a 401 Authentication required response , Any ideas what I may be doing wrong ?

https://osquery.slack.com/archives/C01DXJL16D8/p1664216074578309 anyone could advice?

Major open source n00b questions 😬 What are some tips around maintaining my own codebase that I can share with my team, while also maintaining a “relationship” to the main repo for updates, etc? (or maybe that isn’t a great idea or not possible) -If I fork fleetdm/fleet it has to stay as a public repo -Do I just create my own private clone? -Do I just utilize the .gitignore file for vars, license keys, etc?

I've been lurking for a few days, but I forgot to introduce myself. I've joined Fleet. I'll be focused on improving Osquery visibility on windows and will also be fixing bugs on all platforms

hi fleet team, i found from fleet db the field name in queries table changed with weird val like 'distributed_xxplatform@XXXX.com_1651173157', could someone explain why?

Hi Team, I have the fleet deployed in AWS and is in an unstable state now as all the clients are enrolling together at same time. Any ways i could recover this setup and make fleet online? And also what are the resource requirements for ~200K online clients?

HI All, Is there the ability to reject / prevent a host from checking into fleet ?

https://osquery.slack.com/archives/C01DXJL16D8/p1664216074578309 any update?

Anyone using FleetDM for Device compliance?

Hi fleet team, our fleet cannot show the host list from pack edit page. plz advice.

Hi, I have the weird issue, that two debian hosts got the same ID in fleet and appear taking turns in the hostlist. going to url/hosts/38 sometimes shows host1, sometimes host2. Both hosts have unique hostnames and IPs, (cloud-init took care of that) but were created in proxmox from the same template. I already purged the fleet-orbit package and reinstalled on both, but no improvement. Any idea what I can do to fix and to prevent in the future?

Hi All, I’m having an issue with fleetctl. I can install and issue ‘`fleetctl login`’ and I can enter the username and password. However I constantly get

Error: The Fleet instance is not set up yet

It’s working fine on one Mac, so I’m guessing there’s a dependancy (config file?) missing on the other local machine (and the Fleet Server) I am using… I have a copy of the

fleetctl get config

from the working machine, but of course this is impossible on a non working device, and the error isn’t very informative. So my question is- ‘what are the fleetctl requirements’? ie. what is missing to give that error message?

ok before you send me to the glue factory- I had actually answered my own question in an earlier thread, but for those that strike this issue in future the full answer is- When conecting fleetctl to Security Onion, leave the port number out of the ‘config set’ command ie. don’t use fleetctl config set --address https://so.mydomain.com:8090 --url-prefix /fleet use this- fleetctl config set --address https://so.mydomain.com/ --url-prefix /fleet Fine, yes I was pretty dumb.