Hey y'all, I've been playing around with some queries, and I think the docs for the

xprotect_meta

table might be wrong: https://fleetdm.com/tables/xprotect_meta

min_version

- The minimum allowed plugin version.

But when I query some Macs, I see "com.viewanysearch", which looks pretty sketchy, with its minimum version listed as "any". Should this actually say:

min_version

- The minimum banned plugin version

Hi Fleet team, i am checking the code and seems the response of distributed_read is supposed to contains three elements

Queries:    queries,
Discovery:  discovery,
Accelerate: accelerate,

but when i checking the log of running fleet/osquery, i only see Queries and Discovery, so fleet return it some time or not at all?

How could one collect process_events and socket_events from OSQuery to fleetdm (fleet) and then put it in kafkarest ? I had already gone thro' fleetdm documentation for kafkarest but not really understood the whole setup.

Good morning! When running fleetctl to generate a new package on a Mac OS system (it worked previously), I am getting the following error: "update metadata: unexpected end of JSON input". I have ran the osquery cleanup script to perform a fresh installation, but am getting the same error. Any ideas?

🏗️ New commits pushed to Fleet »

Hi Everyone, I recently inherited a Kolide Fleet instance, and am new to the product. I've been running into an issue with starting up the Kolide web server. I believe I gotten it down to an issue with the mysql database. Currently, when i try to run the command

fleet serve

I get hit with the following error

mysql="could not connect to db: Error 1045: Access denied for user 'kolide@localhost' (using password: YES)

How could I go about trouble shooting the kolide user?

Hi fleet team, is the default val for server​_url​_prefix null?

Hey Team, I am seeing 0 online devices whereas everything was fine until few hours ago. I dont see any err in logs or any error that its not able to communicate with fleet server. Also for alot of devices it still shows last fetched a minute ago and thats keeps updating. Not able to run any query though

Hi Fleet Team, I'm looking to validate it a host/end-point is passing a particular policy through API IS there such a way to do this, currently I can list out the policies and get a count of hosts passing but I am not seeing how to check a given host, I'm hoping I missed something ?

Hi Fleet team - is there a method to separate our scheduled queries by operating system? There are scheduled queries I would like to run that are not applicable to one or more operating systems, and I'd like to keep unnecessary queries from running (Scheduled Tasks queries on Linux systems, for example).

Hi all, does anyone have any idea how to track down what’s causing a “ghost” device to show up in our hosts? Even if it’s deleted, it seems to come back periodically. There’s no info associated with it that I can find, and nothing obvious in the Fleet logs. Thanks for any tips anyone can provide.

Hi Fleet team, I was trying to upgrade my Fleet running 3.11 to 4.25 and unfortunately after the upgrade, my previous username/password combination is not being accepted. Thinking probably configs are lost, tried to set the Fleet up and that gets erred out with error "Error: Fleet has already been setup". Is there anyway I could force reset the fleet or recover password?

Hello everyone, is there a more or less simple way getting the number of all installed outdated packages for linux and macos?

Hi team - how do I determine what certificate is provided to a client when enrolling to my FleetDM server? When downloading the certificate from FleetDM, it is a different certificate than what I have in my fleet.config file, and while both are valid, I think it is causing an issue in the enrollment process.

Hey team - new to fleet 👋 we are seeing data sent from osqueryd process to fleet server even though no packs have been scheduled. we turned off policies, vuln etc. what would be the best way to look at what / why data is being transferred? we are on fleet 4.22.1

@Kathy Satterlee can you help @Meirylene Avelino with their question from #general ?

Hi @Meirylene Avelino! I suspect this may be a permissions issue due to

fleetctl

being installed with

sudo

. Things can get a little weird with npm permissions. Can you check the permissions on the generated installer with

ls -l

?

Hi fleet team, what is default value of redis_database?

Hi fleet team, have you done any testing with a massive number of agents? Are the results of those tests available to the public or through NDAs? I'm not looking for anything in particular, any information is welcome.

🏗️ New commits pushed to Fleet »

Hi fleet team, osquery agent will only depends on osquery APIs to communicate with fleet right? i can c the total count of osquery APIs is 7. is there any other fleet APIs osquery agent depends on?

Q: Is there a minimum version of osquery and orbit that fleetctl v4.26.0 requires in order to be able to build a package? I’m working on our very outdated setup which has a self-maintained TUF repo with the most recent targets of orbit 0.0.3 and osquery 5.2.2, but I’m getting an actual SIGSEGV from the golang packaging code (will include in thread). When I just use the defaults for

--update-url

and

--update-roots

, everything works great! So I figure maybe fleetctl needs a minimum version or something? Which means I just need to get newer binaries of orbit and osquery from….somewhere?

what is ZSCAN/SSCAN request?

https://osquery.slack.com/archives/C01DXJL16D8/p1675166898239869 Any idea on this one. I have an error that node key is missing and secret not found

qq orbit vs https://osquery.io/downloads/debug/5.7.0 https://osquery.readthedocs.io/en/stable/installation/install-linux/ for linux 1. if you have a host with initd rather than systemd … you can’t use orbit right? 2. the orbit package only does systemd registration. 3. in fact the package --service=false option does nothing https://github.com/fleetdm/fleet/blob/9e6ccc48034c0d16f3a872748cbef1a25c9ec6a8/orbit/pkg/packaging/linux_shared.go#L210 I assume there’s no plans to back add initd support since they’re kinda eol or soon eol lts only? I suppose if I want to run osq official and point it at the fleet server can i just grab the cmdl on a similar but systemd linux flavour and make a flagfile to give to osqueryd from the official osq installer? (i get some flags might need to be file not env like secret , or some paths will change but in principle). then make sure the init refs the flagfile?

Trying to do some testing using the Fleet sandbox and I am not able to download the macOS client. The download gets almost done then fails with a “Failed - Server Problem” error. Is there some server error on the Fleet side?

I added a new Windows 2019 server and Fleet shows this device is online. I am not seeing any installed software for this device. It says No installed software installed in this host. I am using the Fleet Sandbox for testing. Is there something I can do to pull the installed software?

hey Team, i am trying to build a query to fetch the loggin profiles/accounts on the hosts so for mac can i get some help how to fetch the loggin apple id?

🏗️ New commits pushed to Fleet »

set the channel topic: ☁️🚀 The latest version of Fleet is 4.27.0. More info: https://github.com/fleetdm/fleet/blob/main/CHANGELOG.md#fleet-4270-feb-3-2023 Upgrade now: https://github.com/fleetdm/fleet/releases/latest