@Rich5 you can change the host identifier to be ephemeral, and that’ll generate a uuid per osquery instance, but then if the daemon restarts you’ll have a new one :/
r
Rich5
07/05/2018, 3:31 PM
Hmm ok. That could cause some fleet manager issues. Im going to need to think on this more
@thor what if we use ephemeral for the first run and then turn it off. Would the agent keep the initial uuid from then on?
Nevermind. I think using specified_identifier=this.is.the.identifier will work
t
thor
07/05/2018, 4:24 PM
right on. Yeah I am pretty sure that if you run with ephemeral then turn it off, it'll just grab host uuid after it comes back online 😕
r
Rich5
07/05/2018, 4:32 PM
we're testing with specified_identifier right now. Seems like it should work, but you never know
well so far using something like this doesn't do anything:
--host_identifier=specified
--specified_identifier=3a3d49c1-b2ef-4cb1-9cdf-d933233e1be0
ah I see where ident is set. It's passed by reference. Sorry I missed that, but it doesn't appear to be written to the db. So then the system_info table still returns the uuid from the product_uuid file
so after testing for most of the day using these switches
--host_identifier=specified
--specified_identifier=3a3d49c1-b2ef-4cb1-9cdf-d933233e1be0
does not appear to do anything. No matter what the agent uses the uuid in product_uuid file
even ephemeral doesn't seem to generate a new uuid. It's always the product_uuid
t
thor
07/05/2018, 6:45 PM
Odd... That might be unintended behavior
r
Rich5
07/05/2018, 6:49 PM
yeah I'm running out of ideas
I've been picking through the code
it's basically like it's just ignoring those flags
ugh I think we figured it out. we had two host_identifier lines in the flag file. so the second one was overwriting the first one set to "specified". So annoying. Sorry to bother you
but it still appears that uuid column in system_info doesn't change if you set the --specified_identifier. Is that by design?
t
thor
07/05/2018, 10:32 PM
@Rich5 might not be by design, but that makes sense, as the uuid value used for enrollment isn't necessarily the same one returned by system info, but I'm not sure if they're supposed to be.
Regardless, glad you got it figured out 🙂
r
Rich5
07/05/2018, 11:28 PM
I think we'll end up having an internal flagfile check that shows duplicates or something. I'm not doing that again