It looks like something is starting osquery automatically.

Hi, do the distributed queries get stored somewhere? I have queries running on the hosts which are not visible anywhere in the UI. There are queries I ran a while ago (> 24h) that are still coming in. Is there a way to purge them?

same tab but different page too or do they close when I go to other pages? I only have 1 tab open and it's on the overview page. I've changed pages many times since starting the queries

Hey folks, I have Fleet running and I can successfully enroll my laptop (Ubuntu 18.04) but when I go to query it nothing happens (I just get the spinning cube animation). Why might this be?

Can you think of a reason why a host would return results twice?

run this first maybe

1.10 is very old

building one on linux is not gonna work

and there's what I see in the Fleet web interface, the osquery enroll secret doesn't even appear

Hello, we've been having issues on a handful of hosts where osqueryd was previously working but suddenly comes up with enrollment errors

(No node key returned from TLS enroll plugin)

. we are able to fix it by refreshing

/var/osquery/db

, but i was wondering if there is a way to just reset the node key without "factory-resetting" osqueryd on the host?

can anyone help me how to forward osquery logs to kibana ??

Is there a specific reason why the launcher windows package uses

nssm

, instead of defining the service using

New-Service

or

sc.exe

?

how does the --root_pem flag work for package_builder make? if the flag is set to "C:\ProgramData\osquery\certs\server.pem" for example, the new host where the package is installed needs to have the file in the same directory on the host machine?

Has anyone got Fleet SSO integration working?

Is this possible through fleet?

Hey guys, First time posting here. I'm thinking about making Kolide high available. I saw in the FAQ that this should be possible. Is there any instructions on how you will need to configure the Kolide regarding the certificates for the TLS-endpoints?

Hi there, I was looking for a query which can monitor the hash binaries. I found the table "signature" for this job, but it only runs on macOS, and I was wondering if there is something else available for Linux operating systems ? (maybe I need to ask this on the general chanel ?)

Hello, Kolide writes by default its logs in /tmp, but is it possible to change this folder ?

I see the docs were updated for 2.2.0, but I don’t see 2.2.0 on https://github.com/kolide/fleet/releases

how this new GCP plugin works? osquery sends the logs to GCP pubsub and kolide ingests them from GCP storage? or GCP storage is used as kolide backend?

couple of development questions about kolide/fleet: 1) Are there plans to split the API code from the frontend code? 2) Are there plans to support better frontend development tooling (latest webpack, hot module replacement, webpack dev server, etc)

Results of the query.

im unable to connect my host to kolide

Hi all, I am hopping someone can help me get some clarity in how to build and deploy launcher

yeah launcher -> fleet requires NLB

I’m trying to deploy fleet on GCP and was wondering if i could use cloud sql for the database and memorystore for redis. then could i just deploy the fleet server in kubernetes and connect all the pieces together?

Please, can you help me with this: https://osquery.slack.com/archives/C1XCLA5DZ/p1563451125060500

Hi, I'm having problems with Fleets data (result.log and status.log). First I changed anything about the logs, so Fleet wrote its logs in /tmp, and I had no problem to read them. Then I wanted that Fleet write the logs in a specific folder, so I added these lines to the config file :

filesystem:
        result_log_file: /opt/fleet/log/result.log
        status_log_file: /opt/fleet/log/status.log
        enable_log_rotation: true

but in /opt/fleet/log, I can see nothing. I wondered if this could be an access problem, but my Fleet has normally all the rights to write into this folder.

Does anyone know if there is a way to create custom labels using

fleetctl

hi there! I’m playing around with the pubsub kolide plugin and it seemsl ike I’m getting this error:

{
  "error": "error writing status logs: pubsub publish: rpc error: code = PermissionDenied desc = Request had insufficient authentication scopes."
}

on the endpoint, not the fleet server. Does this imply that using the pubsub plugin means that we have to give all application default credentials in the entire set of endpoints talk to the pubsub queue?