Channels
doorman
infrastructure
random
zercurity
community-feeds
fleet-dev
code-review
queryhub
apple-silicon
carving
tls
fim
goquery
zentral
aws
querycon
golang
zeek
file-carving
fuzzing
auditing-warroom
linen-dev
fleetosquery
plugins
jobs
arm-architecture
darkbytes
process-auditing
uptycs
android_tests
selfgroup
vendor-feeds
fleet
eclecticiq-polylogyx-extension
ebpf
website
core
general
macos
kolide
osctrl
extensions
foundation
sql
officehours
linux
windows
Title
d
David J Davis
07/27/2022, 8:46 PMHow long is software kept in FleetDM's software inventory after it is no longer detected in the environment?
k
Kathy Satterlee
07/27/2022, 9:06 PMHi, @David J Davis! What version of Fleet are you running?
Software inventory by default updates once an hour, but there was a tweak made in 4.16.0 to better handle orphaned software.
d
David J Davis
07/27/2022, 9:15 PMFleetDM Premium 4.16
k
Kathy Satterlee
07/27/2022, 9:43 PMAre you seeing any unexpected behavior with Software lingering longer than expected?
How often software updates depends on the value set for
FLEET_VULNERABILITIES_PERIODICITYd
David J Davis
07/28/2022, 12:28 PMThanks for the information. I use a Fleet live query to gather a software inventory daily and populate/update a SQL database. I was looking for a way to clean this database of applications no longer present in the environment.
I can't really use the live query, because it's not always complete, works fine for populating/updating as it's done daily. However, for removal, if a machine is temporarily offline and is the only one with a specific piece of software, then it could get removed and then added when the machine comes back online.
So software is updated hourly by default, what if a machine is still in FleetDM's hosts DB, but is offline, would that cause Fleet to remove any software that had been found on that machine in the past?
k
Kathy Satterlee
07/28/2022, 2:11 PMOnly the online hosts are updated, so that shouldn't be an issue!
d
David J Davis
07/28/2022, 2:30 PMSo would the software get removed if the machine is offline or remain until the machine got cleaned from the hosts DB?
or came back online and got a software inventory update.
k
Kathy Satterlee
07/28/2022, 2:42 PMThe software will remain until the host comes back online or is removed.
d
David J Davis
07/28/2022, 3:01 PMOK, that is excellent, that should work for my purpose.
k
Kathy Satterlee
07/28/2022, 7:36 PM@David J Davis If the publisher from the programs table was used to populate the
vendorLetting those ideas percolate.