Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hi All - what is the best way to check install logs in fleet/osquery? Trying to see info on when the install happened on an endpoint and why it just got added to fleet 8 days ago (user was hired a few months ago)

Are you able to check your server logs? A lot of software installation information is stored there.

I’d would also suggest looking at the `fleetd` logs on the host.

How did you enroll the host? Are you able to refetch the vitals for that host? Upon refetch, the software inventory should repopulate.