Hey guys,
we recently use fleet carve feature try to pull a file from all of our hosts, there are two issues we found:
1. In one carve request for each host, there are multiple carve_metadata records generated in database in a different time (most of hosts). Looks like multiple carve requests from osquery agent sent to fleet.
2. Even though there are multiple carve_metadata records, part of hosts are still not able to upload data to database. (All their carve_metadata.max_block value is -1, as I understand that means no block created for the carve_metadata)
Issue 2 is more important, because we are missing part of hosts upload file via carve.
Anyone has insight on why this happened?