I’ve freshly installed and configured Osquery on a client computer when Kolide Fleet TLS server isn’t running. (that client has never been enrolled with the fleet before.)
Just after that, I have the Fleet run but this new agent hasn’t showed up on the Fleet. It has been added to Fleet after i restarted osqueryd service of the agent.
in this respect, it should be a flag releted to this situation. in other word i shouldn’t have to wait the service to be restarted
meanwhile, i’ve tested an other case related to above.
In the case of agent has been enrolled/added to the Fleet server “earlier”….
- I stopped the osqueryd service of my earlier enrolled agent
(it turned to offline state on the fleet)
-I stopped the fleet server
-after a while, I started the osqueryd service on my agent
-I started the fleet server
-my agent turned into online state on fleet server instantly
What can i do about the first case?
also I deleted an earlier enrolled host from fleet and I repeated the test and the host showed up instantly on fleet.
So the first case is weird. Any idea?