https://github.com/osquery/osquery logo
Title
w

wennan.he

10/12/2022, 7:24 PM
Hi osquery team, does osquery have feature of auto upgrade? is there any way to turn that off?
t

Thomas Stromberg

10/12/2022, 7:25 PM
As far as I know, it does not - though commercial osquery launchers do have it built-in (Kolide, probably Fleet & others)
w

wennan.he

10/12/2022, 7:26 PM
so you mean fleet will upgrade enrolled hosts?
t

Thomas Stromberg

10/12/2022, 7:27 PM
I assume yes, but you may want to ask in #fleet
w

wennan.he

10/12/2022, 7:29 PM
i see parts of our hosts upgrade with osquery but not all.
if fleet does it, why it upgrade only some of them.
s

Stefano Bonicatti

10/12/2022, 7:30 PM
As far as I know the auto update feature works through Orbit (from the FleetDM folks), which is an optional way to deploy osquery. So it depends on how you’ve deployed osquery?
w

wennan.he

10/12/2022, 7:35 PM
@Stefano Bonicatti thx 4 response, that is really valuable. we really have a lot hosts running osquery with orbit which is probably the root cause.
s

seph

10/12/2022, 9:25 PM
Native osquery does not. Kolide Launcher has an update mechanism. FleetDM’s Orbit does as well. Other vendors may, but I don’t know as much about them