Hello! I’m running osquery in Oracle Linux Server however it shows Red Hat Enterprise Linux Server instead in the console. What configuration should I modify so that it will show the exact /etc/os-release of the server?

Hello @Teel, are you seeing the wrong name in Fleet or is osquery returning the wrong value? Do you see the correct name when you run

SELECT name FROM os_version;

?

Hi @Dale Ribeiro, it keeps on showing “Red Hat Enterprise Linux Server” when I run the query you provided. It supposed to show “Oracle Linux Server”. This is both from osqueryi command and fleet console. I’m running v5.8.2

@Teel what is the content of the file "/etc/redhat-release" ?

@Keith Swagler it’s /etc/os-release and it contains the OS version and “pretty name” of the server

apparently you should have both, the reason I ask is that osquery checks both and if one is different than the other it could be because of packages

Oh I saw that it contains different versions. One is Oracle Linux Server and the other is Red Hat Enterprise Linux. Is there a way that the one in /etc/os-release will be the version it will reflect in the fleet console?

you could change the text is those files on a test machine or container and see what the results are