https://github.com/osquery/osquery logo
a

Artem

05/26/2021, 9:23 AM
Hello again! Could you please help me to understand some details about “instance” host_identifier? Where is it actually stored? And in what cases can it change? Reboot? Reinstall/update Osquery? I am trying to solve problems for identifying users’ endpoints when hostnames can be duplicated (like default “MacBook Pro”), which leads to problems with enroll. It seems that uuid is a good option for users, not servers. We tried the instance, but it seemed that after reinstalling / updating osquery, the entries are duplicated in the flit.
*Fleet Sorry 🙂
s

Stefano Bonicatti

05/26/2021, 10:10 AM
The instance identifier is stored in the database and generated once using a random uuid generator
So as long as you carry around the database, that won't be re-generated
t

theopolis

05/26/2021, 1:01 PM
Does “uuid” work instead?
a

Artem

05/26/2021, 4:10 PM
@theopolis hi! We started to test, so I will answer after couple of days :)
t

theopolis

05/26/2021, 4:32 PM
uuid is my recommendation but there’s nothing that enforces machines to use truly unique uuids :) and practically you may find that virtual machines reuse static/know uuids.
3 Views