Hey guys, we recently use fleet carve feature try ...
# general
j
Hey guys, we recently use fleet carve feature try to pull a file from all of our hosts, there are two issues we found: 1. In one carve request for each host, there are multiple carve_metadata records generated in database in a different time (most of hosts). Looks like multiple carve requests from osquery agent sent to fleet. 2. Even though there are multiple carve_metadata records, part of hosts are still not able to upload data to database. (All their carve_metadata.max_block value is -1, as I understand that means no block created for the carve_metadata) Issue 2 is more important, because we are missing part of hosts upload file via carve. Anyone has insight on why this happened?
s
This sounds like a fleet question (not osquery) try #C01DXJL16D8
j
Yeah, I did ask this in fleet channel as well. Thanks!