https://github.com/osquery/osquery logo
Join Slack
Powered by
Hi, I installed fleet server and generated rpm pac...
# fleet
i
Hi, I installed fleet server and generated rpm package for linux and msi package for windows, but once installed I have to go to gui every time and click on "Refresh" to refresh pc data, is it possible to enable auto refresh agent to send data automatically every few minutes?
k
Hi, @Ibra! There are several intervals you can set in your configuration. It sounds like you may be looking for the 
osquery_detail_update_interval
, which is set to 30 min by default. You can check out all of the configuration options in the documentation. If that doesn't answer your question, just let me know more about the info you're wanting to keep more up to date and I'll be happy to take a look.
i
Hi @Kathy Satterlee, thanks for your reply, but I used this for server-side installation (https://fleetdm.com/docs/deploying/server-installation#fleet-on-cent-os) and it does not allow me to change parameters, can you tell me how to install it on centos using the source code instead of the Fleet bin file? i used the bin file by downloading the tar.gz and then used fleetctl to generate the packages. do you know how to install it via source code so I can make all the possible changes?
Do I have to install osquery separately on the server and on the agents? I know it is included in the package that is generated under the name orbit
when i do fleet --help i can see
Copy code
osquery:
  node_key_size: 24
  host_identifier: provided
  enroll_cooldown: 0s
  status_log_plugin: filesystem
  result_log_plugin: filesystem
  label_update_interval: 1h0m0s
  policy_update_interval: 1h0m0s
  detail_update_interval: 1h0m0s
  status_log_file: ""
  result_log_file: ""
  enable_log_rotation: false
  max_jitter_percent: 10
  enable_async_host_processing: "false"
  async_host_collect_interval: 30s
  async_host_collect_max_jitter_percent: 10
  async_host_collect_lock_timeout: 1m0s
  async_host_collect_log_stats_interval: 1m0s
  async_host_insert_batch: 2000
  async_host_delete_batch: 2000
  async_host_update_batch: 1000
  async_host_redis_pop_count: 1000
  async_host_redis_scan_keys_count: 1000
  min_software_last_opened_at_diff: 1h0m0s
it's correct?
k
Yes, that's the Fleet server's osquery configuration. You can apply the configuration values you want to your existing installation using environmental variables:
Copy code
FLEET_OSQUERY_DETAIL_UPDATE_INTERVAL=30m
By applying a flag when starting the server:
Copy code
fleet serve --osquery_detail_update_interval=30m
Or by creating a 
.yml
file with the value(s) you want to set:
Copy code
osquery:
  detail_update_interval:30m
And then specifying that file when starting the server:
Copy code
fleet serve --config <your file>.yml
If you're using the command specified in that guide to start the server:
Copy code
/usr/bin/fleet serve \
  --mysql_address=127.0.0.1:3306 \
  --mysql_database=fleet \
  --mysql_username=root \
  --mysql_password=toor \
  --redis_address=127.0.0.1:6379 \
  --server_cert=/tmp/server.cert \
  --server_key=/tmp/server.key \
  --logging_json
The simplest/closest to what you're already doing option would be to add it as a command-line flag to that command:
Copy code
/usr/bin/fleet serve \
  --mysql_address=127.0.0.1:3306 \
  --mysql_database=fleet \
  --mysql_username=root \
  --mysql_password=toor \
  --redis_address=127.0.0.1:6379 \
  --server_cert=/tmp/server.cert \
  --server_key=/tmp/server.key \
  --osquery_detail_update_interval=30m \
  --logging_json
I used 30 minutes in all of my examples, but you can pick the time that works best for you 🙂
i
thanks, however if I have the variable set to 30 minutes, why do some devices update after 1 hour?
I am going to update the osquery variable by setting 5 minutes and I would like to figure out how to do auto fetch on the server so that it always goes and gets the data from osquery without my access
If I go to change the variable now, does it also take the change for hosts already entered? Do I have to go and regenerate the msi package?
5 Views
Open in Slack
PreviousNext
Powered by