ah yes of course, all I can see is the json that fleet outputs though, does fleet handle whatever is posted to the endpoint specified in tls_logger_endpoint, or what does one use for that?

@shed7 distributed queries are just output to the UI (or CLI) and not stored in the result log file. The result log file contains the results from scheduled queries.

I see the paths set in the

file_integrity_monitoring_files

table in the

kolide

db. How does one control which endpoints receive this FIM config?

I remember reading somewhere that Kolide Cloud was "free for your first 10 devices". Has that changed? Can't find any mention of this.

weird. I would’ve thought you’re running into url escaping, but this doesn’t look right

i believe this EOF bug was addressed in 2.0.0 rc5 but i can’t find the commit that did it

@R0n osquery logs those to where you have your logger_plugin configured to.

What I mean is that the enroll just be accessed by osqueryd when it start and the osqueryd will never access the enroll when it has enrolled successfully.Is that true? @groob

server logs should tell you why

Hey there, Curious, are there any variables that fleet controls which impacts server eps when receiving incoming logs from client's through query packs? I've set

logger_tls_period: 1

because I want the logs returned as the client is done with the query instead of waiting out a buffer timer (I had tried setting it to 0 but faced worse results then when it was set to 1). I'm doing event per second per server testing (still)

Basically, my above question is regarding back to this issue, and if receiving results 1 by 1 is the desired outcome currently and going forward. https://github.com/kolide/fleet/issues/1895

Dear Kolide team: what is your suggestions to log offline machine to fleet into the osquery_result json? or maybe there's another approach I should take to check that into some sort of exportable logs? Thanks a bunch 😄

Hi Kolide team! Where in the fleet source code is the live shell on a host feature implemented? Thanks 🙂

Btw, have you guys considered creating osquery for mobile devices? Is that even possible? A lot of smartphone antivirus products don’t work on iOS, but even if they did, they wouldn’t be nearly as lightweight as

osquery

Quick question, where are you guys pulling the “IPv4” field in fleet? I am looking to make some labels that will do some sorting based on the ipv4 address.

Does the bearer token ever expire? Looking to use a script to poll the

host_summary

API endpoint on a reoccurring schedule and would prefer not to have to worry about updating the token

Quick question, what library are you guys using to auto-complete queries in kolide.com?

Any way to create a user with an invalid username?

Hi , I know that Kolide server can log the results osquery agents in a central log file. May I know where I can I see those logs? My osquery_result is empty

Hi,I want to konw when the osqueryd access the enroll api,which file in the fleet will deal the url?I can find the mapping from url to the file in fleet. I have read the fleet source code,but I still can't find it.does anybody konw?

sveta [3:00 PM] TLS/HTTPS POST request to URI: https://localhost:8080/api/v1/osquery/config {"node_key":"yy9kqIUepFvm1sD1SmQFg9jkSxM+mrNQ"} 400 Bad Request

would

fleetctl query

work?

hi guys,I want to konw,if I use the osquery remote api,I should set the --config_plugin=tls,the setting means that I must use https but not http?

hello, I cannot enroll with fleet server, osqueryd output is "tls_enroll.cpp:66] Failed enrollment request to https://172.20.17.23:8080 (Cannot parse JSON: Invalid value. Offset: 0)".

@ryan have you set --config_plugin=tls?

Do we have to have at least one local admin account in fleet? Can we gut it after SAML setup?

@Woogs I have my currently set at 120, and was thinking about pushing it back to 300. IF I could have the configs separate from the packs I would have the packs at 300 and configs even further back.

what if we allow you to turn the UI off? would a CLI-only workflow be sufficient for your needs?

Can I change the default schedule that fleet give the osquery when the osquery first access the /config api in fleet?

These logs can be found in the following locations:

Status Log: /path/to/status/logs

Result Log: /path/to/result/logs

I find this desc in fleet manager page,so if I don't use the fleet default setiing,where is the log?