Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

On our Fleet server, we're getting ~5k warning-level log messages an hour with some iteration of:
&gt; updateModifiedHostSoftwareDB: last opened at is nil for new software, but not for current software
The software indicated is all over the place. I don't see any GitHub issues for this; any direction on addressing it to lower the noise level of our logs? Fleet v4.69.0

Hi <@UN9SVU8JW>. Sorry about that log chatter! We have an assciated bug ticket here:

<https://github.com/fleetdm/fleet/issues/29061>

Hmm. With the log volume we’re seeing, I’m surprised it’s so hard to reproduce

But I get production is not the same as test/dev. Subscribed to the issue for now since it sounds like they don’t need any external validation. Hopefully it’s addressed soon. Between that and <https://github.com/fleetdm/fleet/issues/28996|https://github.com/fleetdm/fleet/issues/28996> our Fleet server is logging a couple orders of magnitude more errors and warnings than our other dozen servers combined.

That's definitely less than ideal, and not what we want to see.