https://github.com/osquery/osquery logo
Join Slack
Powered by
How long is software kept in FleetDM's software in...
# fleet
d
How long is software kept in FleetDM's software inventory after it is no longer detected in the environment?
k
Hi, @David J Davis! What version of Fleet are you running?
Software inventory by default updates once an hour, but there was a tweak made in 4.16.0 to better handle orphaned software.
d
FleetDM Premium 4.16
k
Are you seeing any unexpected behavior with Software lingering longer than expected?
How often software updates depends on the value set for 
FLEET_VULNERABILITIES_PERIODICITY
. The default is 1 hr.
d
Thanks for the information. I use a Fleet live query to gather a software inventory daily and populate/update a SQL database. I was looking for a way to clean this database of applications no longer present in the environment.
I can't really use the live query, because it's not always complete, works fine for populating/updating as it's done daily. However, for removal, if a machine is temporarily offline and is the only one with a specific piece of software, then it could get removed and then added when the machine comes back online.
So software is updated hourly by default, what if a machine is still in FleetDM's hosts DB, but is offline, would that cause Fleet to remove any software that had been found on that machine in the past?
k
Only the online hosts are updated, so that shouldn't be an issue!
d
So would the software get removed if the machine is offline or remain until the machine got cleaned from the hosts DB?
or came back online and got a software inventory update.
k
The software will remain until the host comes back online or is removed.
d
OK, that is excellent, that should work for my purpose.
k
@David J Davis If the publisher from the programs table was used to populate the 
vendor
field in the Software API, would that get you the data you need?
Letting those ideas percolate.
2 Views
Open in Slack
PreviousNext
Powered by