https://github.com/osquery/osquery logo
Title
j

Jason

02/08/2022, 4:15 AM
Hi - I've made what I thought would be a really simple change to our configuration. I'm just changing the hostname decorator to reflect the computer_name rather than the DNS hostname.... I made this change via fleetctl
agent_options:
    config:
      decorators:
        load:
        - SELECT uuid AS host_uuid FROM system_info;
        - SELECT computer_name AS hostname FROM system_info;
But my fleet UI still shows the hosts with decorators ending in ".local" etc. (for home users). Is there a significant lag (24hrs maybe?) for this to take effect?
s

sharvil

02/08/2022, 12:00 PM
hi there! I am not sure about the UI, but I noticed that the decorators are of type
load
in the config, which usually means that those queries are only run when the config is loaded, maybe try changing them to
always
and see if that works?
t

Tomas Touceda

02/08/2022, 12:11 PM
hi! we do get the hostname from this query:
select * from system_info limit 1
, unless the decorator changes what's returned there, it probably won't change it
1
j

Jason

02/08/2022, 2:12 PM
Ah so the fleet UI isn't modified by decorators - ok then that makes sense. I can just see how the output looks on the logs.