hi fleet team, how can i know the options i change...
# fleetw
wennan.he
10/13/2022, 7:09 PMhi fleet team, how can i know the options i change in ui is pushed to agent side?
k
Kathy Satterlee
10/13/2022, 7:16 PMA good way to check is by querying the
osquery_flagsSELECT name, value FROM osquery_flagsKathy Satterlee
10/13/2022, 7:16 PMYou could include a
WHEREw
wennan.he
10/13/2022, 7:20 PMwell, i am confused, you mean all the options i changed in ui is also storing this osquery_flags table?
k
Kathy Satterlee
10/13/2022, 7:32 PMWhat I'm recommending there is querying your hosts using Fleet, not the Fleet database. The response you get back will be the flags that are set on the host.
Kathy Satterlee
10/13/2022, 7:33 PMSo you can set the options you want in the UI, then wait a bit to give the hosts time to check in and get the configuration, then query the hosts to verify that the flags you set are reflected in the response.
w
wennan.he
10/13/2022, 7:33 PMyes, i understand, so my question is why i cannot push flags also through fleet ui like disable_events?
k
Kathy Satterlee
10/13/2022, 7:35 PMBecause osquery does not support setting command-line flags through the
configKathy Satterlee
10/13/2022, 7:42 PMAnd Fleet does not write to your system, so it cannot change startup commands or flag files.
Kathy Satterlee
10/13/2022, 7:44 PMThere is work being done to allow this with Orbit that you may want to keep an eye on!
https://github.com/fleetdm/fleet/issues/6851
w
wennan.he
10/13/2022, 8:30 PMok thx 4 explain