Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hi everyone!  I recently upgraded our fleet to 4.32 and noticed the lack of the ‘packs’ functionality and have trolled through Slack to see that this is intentional.  Beyond paying for Teams, is there a way to target individual/a subset of machines to write logs to the local fs, instead of through an ad-hoc query?  What is the best practice moving forward for this?  We have some queries that are designed for servers that we don’t see a need for running on non-server systems, or on other servers, and currently we target the intended machines with a label.  I also notice we can target existing labels, is there a way to create new ones, or are labels being depreciated like packs as well?

On some level I am a bit irked, as this was the only way to target machines initially, and it feels like packs being deprecated without a full path forward for non-premium users at all is heavy handed, and even with premium users you need to add them to teams, and a device can only belong to one team.

Hey again <@U0GJPD3GU> :slightly_smiling_face: Sorry for any frustration there! Packs will definitely be sticking around in some form, but things have gotten a bit away from their original intended use (an easy way to import and export queries). We're definitely still working out exactly what the future looks like there, but until we do, the Packs functionality will continue to exist as-is, we've just removed the button in the UI.

As far as I'm aware, labels aren't going anywhere.

For now, you can still manage packs through `fleetctl`, or in the UI at `/packs/manage`.

You can also manage labels through<https://fleetdm.com/docs/using-fleet/configuration-files#labels| >`fleetctl`, in the UI at `/labels/new` or the <https://fleetdm.com/docs/using-fleet/rest-api#labels|REST API>.