@thor what if we use ephemeral for the first run and then turn it off. Would the agent keep the initial uuid from then on?

Nevermind. I think using specified_identifier=this.is.the.identifier will work

well so far using something like this doesn't do anything: --host_identifier=specified --specified_identifier=3a3d49c1-b2ef-4cb1-9cdf-d933233e1be0

we still get the old uuid it generated

osqueryi "select uuid from system_info;" +--------------------------------------+ | uuid | +--------------------------------------+ | 8B344D56-855F-DEAC-A75F-B2D957C117C7 | +--------------------------------------+

maybe you can double check what I'm seeing here. When the agent enrolls using the tls plugin if calls getHostIdentifier here: https://github.com/facebook/osquery/blob/5aca61375f187fe8b767e186fe2a592749ce1ba7/osquery/remote/enroll/plugins/tls_enroll.cpp#L80

getHostIdentifier should then call getSpecifiedUUID if the flags are set https://github.com/facebook/osquery/blob/74cee943f30d595e95b01ad557ff23297b1ae337/osquery/core/system.cpp#L258

but one I don't see ident (which is returned set to the results from getSpecifiedUUID in the getHostIdentifier function

and two if we then query select uuid from system_info it calls getHostUUID here https://github.com/facebook/osquery/blob/5aca61375f187fe8b767e186fe2a592749ce1ba7/osquery/tables/system/linux/system_info.cpp#L33

which then checks the database first for a uuid and returns that or it generates one by calling generateHostUuid

which ultimately just uses the uuid located at /sys/class/dmi/id/product_uuid

ah I see where ident is set. It's passed by reference. Sorry I missed that, but it doesn't appear to be written to the db. So then the system_info table still returns the uuid from the product_uuid file

so after testing for most of the day using these switches --host_identifier=specified --specified_identifier=3a3d49c1-b2ef-4cb1-9cdf-d933233e1be0 does not appear to do anything. No matter what the agent uses the uuid in product_uuid file

even ephemeral doesn't seem to generate a new uuid. It's always the product_uuid

I've been picking through the code

it's basically like it's just ignoring those flags

ugh I think we figured it out. we had two host_identifier lines in the flag file. so the second one was overwriting the first one set to "specified". So annoying. Sorry to bother you

but it still appears that uuid column in system_info doesn't change if you set the --specified_identifier. Is that by design?

Regardless, glad you got it figured out 🙂