https://github.com/osquery/osquery logo
Title
d

Dan Achin

09/22/2020, 6:50 PM
Does anyone know how long fleet (by default) waits for a client check-in before it marks that client offline? Also, which client setting controls the 'check-in'? I'm guessing there may be various client actions that could signal to fleet that a client is online, including a config_refresh, or checking with the distributed query server to check if there are queries to execute (i.e. distributed_interval) and others. Any guidance?
d

Dan Achin

09/22/2020, 6:54 PM
thanks
wouldn't a config refresh or a check for new queries generally flag a client as online?
z

Zach Zeid

09/22/2020, 6:56 PM
I think that might be
--config-refresh
on the client side.
There is also #kolide for these questions that might go further.
d

Dan Achin

09/22/2020, 6:58 PM
ack, thanks again.
z

zwass

09/22/2020, 10:47 PM
The linked code is the duration for MIA (hosts that have not been seen for 30 days). The online status is calculated for each host based on the observed intervals set for
config_refresh
,
logger_tls_period
, and
distributed_interval
. IIRC we give some grace period over the "expected" interval.
👍 1