Hey All! Quick question. When collecting Fleetdm osquery logs, is it possible to include the private IP address in the logs? So its easier for us to know which instance the logs are coming from? The UUID is not very convenient for us. The private IP is already included in the UI, is there a way to add that host IP into the logs?

Hey @Darshal Shah Decorators might be what you are looking for :) https://fleetdm.com/docs/configuration/agent-configuration#decorators

Thanks! So which type of query should I put there in order to get the IP address of the hosts? I put the following query but it turns green after I save it and I am not getting the IP address info. Can you please help?

You're seeing the green because you've wrapped the query in quotes. If you look at the osquery logs on your hosts, you'll likely see an error indicating that the decorator query is returning more than one row. Those queries need to be written so that they will only return one result per query.

So I didn’t wrap it in quotes. After I saved it, it wrapped itself into quotes, and turned green. I fixed that so that its now seperated into two different queries, and its not turning green anymore. But I am still not seeing the IP address in the logs

That's likely because this query would generally return more than one row of results.

image.png

I'd expect each of those queries to return multiple rows of results since there are multiple interface addresses.

Thanks Kathy! Will give that a try

Those indicate when the decorator query should be rerun to update the values. Since hostname isn't likely to change frequently,

load

should be plenty frequent. load - updates every time config is loaded in osquery always - updates every time results are generated interval - updates every x seconds

Hey @Kathy Satterlee thanks for that. What could be the reason that none of the information under decoraters is in the logs?

Do you have any settings in “overrides”?

yes

You’ll need to include your full options in overrides as well. The two are not merged, so any hosts that match that platform are only getting the options specified in overrides.

so basically put this whole thing right under overrides?

Everything you want applied to that platform.

Thanks a lot Kathy! I actually figured it out, and it seems to be working. But feel free to send the rough outline, I am sure it will come in handy in the future!

Making a visual that makes sense is proving to be more time consuming than anticipated 🙂 As long as it makes sense, you're golden.

Yes it does make sense. I think atleast lol. But yeah no worries thanks a lot for your help!!