with the tls config plugin, are there expected situations a host will re-enroll other than receiving an invalid node_key response from the server?

Presumably missing local databases.

huh. so, i went off to take a peek at this; in at least one case the db appears to be there, but it doesn't look like osqueryd has touched it in... awhile

Are you sure it’s using that database?

lsof appears to show it having multiple fds open in the expected folder, at least

Okay then.

i've always assumed that the IDENTITY file in osquery.db is related to the node_key; do you know if that's correct?

I don’t think this is true, no. I think the identity file is related to rocks specifically. It helps the system know which SST files to use. Not sure how this plays a role with the manifest

the short version is that it looks like doing: service osqueryd stop rm -rf $osquery_db is not a great idea; in some cases the worker will still be alive and still have fds open even though the daemon is gone