Hi osquery team, does osquery have feature of auto upgrade? is there any way to turn that off?

As far as I know, it does not - though commercial osquery launchers do have it built-in (Kolide, probably Fleet & others)

so you mean fleet will upgrade enrolled hosts?

I assume yes, but you may want to ask in #fleet

i see parts of our hosts upgrade with osquery but not all.

As far as I know the auto update feature works through Orbit (from the FleetDM folks), which is an optional way to deploy osquery. So it depends on how you’ve deployed osquery?

@Stefano Bonicatti thx 4 response, that is really valuable. we really have a lot hosts running osquery with orbit which is probably the root cause.

Native osquery does not. Kolide Launcher has an update mechanism. FleetDM’s Orbit does as well. Other vendors may, but I don’t know as much about them