Does anyone know how to configure emails for their accounts? do I HAVE to set up a smtp server on my host ? trying to reset password and I'm getting an "email not configured" error

With Kolide portal's right sidebar with OS groups, is there aconfiguration change to add another OS group? For example, what if I wanted another distro other than Ubuntu?

Hi All, Does osquery-go have support for windows? If yes, have any of you had any experience with it?

When I try to download my certificate I get

username or email and password do not match

. does anyone else have this issue?

Hi all. I've spun up fleet with

/usr/bin/fleet serve   --mysql_address=127.0.0.1:3306   --mysql_database=kolide   --mysql_username=root   --mysql_password=XXX  --redis_address=127.0.0.1:6379   --server_cert=/root/server.cert   --server_key=/root/server.key --logging_json --auth_jwt_key='XXX'

on a centos 7 box. I was able to get through the initial setup and create an admin user. When I try and login with the that user, the server seems to authenticate me and starts to put up the UI, but then immediately goes back to the login page. The server is logging out a continual stream of

{"component":"http","err":"no auth token","ts":"2019-10-18T07:51:29.398720629Z"}

messages. The fleet version is 2.3.0. Any idea what might be going on?

Hi all, i have a strange issue. Logs randomly just stopped being sent to my AWS ELK instance at 07:30am. The results from the query packs are still being logged succesfully to the osquery_results file on the server, and filebeat can still connect to the ELK stack when i test the connection. Anyone seen anything like this before?

You can do this pretty easily via the API why did you try and edit the DB ?

That would be amazing, been trying to figure this out for a while now. Any code examples for how to the results out via the API would be greatly appreciated 🙂 Thanks.

yes I’ve ‘enjoyed’ that behaviour too. I copy and paste the query into a text editor, do my thing and then paste back

Question for some Kolide / osquery experts out there. We're enrolling some Mac's into Kolide Fleet and we're seeing some sporadic results in how the host_identifier is being reported to Fleet. We're using osquery 4.0.2. Sometimes machines that are enrolled send up the proper hostname value for the machine, other times we're seeing "localhost" in Fleet. When I run

select * from system_info;

locally on one of the endpoints that are showing up as "localhost" in Fleet, osquery is actually populating the hostname field with "localhost". So I believe Fleet is just reporting (properly) what osquery is telling it. On the same machine when I run hostname (outside of osquery), I'm getting the correct results (gives me the computer name). Anyone else have this issue with the "hostname" field not actually populating correctly with the hostname of the machine?

I don't think you can change that without editing the source code of fleet. It's harcoded to be the hostname which we collect and store in the back-end database

pretty sure no one changed the access to the db like passwords

I've got Fleet set up with the kinesis log plugin. This is not a new setup but I'm doing some review and I don't seem to be getting status logs in Kinesis. Does fleet have some default value that would disable status logs to kinesis? Or is there some option / flag I need to set to get the logging working to Kinesis? (I have not modified anything related to status logging flags either in my flag file or in fleet's options)

Is it possible to federate multiple Fleet instances?

Hey all, I've just started testing Fleet after if sadly fell off my radar a while back and I'm not seeing any results appear in the results .log file. I have configured

--filesystem_result_log_file=/var/log/osquery/result.log

and the fleet service has created both log files. status.log is populating as expected, but result is empty at the moment. I have set up a query in a pack, which is mapped to a test host. I can happily run ad-hoc queries against the host and see the results in the GUI, so I know the two are talking. Is there anywhere obvious I should be checking in my troubleshooting, please? (appreciate this is pretty vague info!)

Hey <!here>, Fleet 2.4.0 has been released with a couple of nice new features. Take a look at the changelog (https://github.com/kolide/fleet/releases/tag/2.4.0) and upgrade when you get the chance. As always, please file issues regarding bugs and feature requests on GitHub, and look to the community for support here in this channel.

Is anyone else interested in RBAC for restricting the ability to query certain tables? I might be able to get my employer to sponsor adding that feature to Fleet.

Seeing issues with labels not updating correctly. I have around 1,200 hosts reporting in and when selecting a label for Windows hosts (which should match the inbuilt one), 0 hosts show up. If I edit that label (by changing nothing) and select update then hosts report in. If I repeat that process, a few more hosts report in. Any ideas why this isn’t populating correctly and dynamically?

@defensivedepth I don’t think there are any specific windows instructions. And aside from wix and go, there aren’t requirements. If you want to take an edit pass at https://github.com/kolide/launcher/blob/master/docs/package-builder.md I’m happy to read it, but I do not want to recommend chocolatey.

I’m happy to figure out something for https://github.com/kolide/launcher/issues/546

hiya if i set server-tls to false, will i be able to just put this in a docker in an ec2 instance and then send it traffic over http using amazon load balancers?

I recently changed the host identifier for my fleet, and I got quite a few duplicates kicked up. Is there a way to 'clear' all hosts where status == 'offline'?

how many machines are monitored for one kolide server node?

Hey getting a access denied to MySQL when trying to setup Kolide. Doing the migration step. Mysql is on the same box

id like to set up SAML automatically without having to have a credential floating around, set up the URL and stuff etc

also, anyone have experience getting logs from fleet to sumologic?

@zwass do you have tips on how to build a dev env for fleet

Hey! Does anyone understand how the autogeneration of mocks work in fleet? I’m trying to fix an issue with my PR that is causing a

panic: runtime error: invalid memory address or nil pointer dereference

when the test

TestNewDistributedQueryCampaign

is run

In Fleet: is there a way to query on the hostname of an endpoint when creating a new Label?