Hello all, I'm working with some RHEL endpoints being hosted on AWS. I'm attempting to clone one of my endpoints and add the clones to fleet but when I do, fleet seems to confuse the original with the clones. I've changed the hostnames and made sure that they all have different IPs and serial number. When i add them to fleet, they do not show up as individual endpoints but when I try to Refetch the original endpoint i see its IP change and the hostname change. So it seems like fleet thinks that they are all the same endpoint. Anyone encountered this before?

I believe you want to change the config in fleet to use a different identifier for hosts https://fleetdm.com/docs/deploying/configuration#osquery-host-identifier

thank you!

Yes, that's the correct docs. You could try changing the config so that fleet uses a better identifier, and then delete the hosts in fleet (they will re-enroll after being deleted)

https://fleetdm.com/docs/deploying/faq#what-is-duplicate-enrollment-and-how-do-i-fix-it may also be helpful

Thank you, appreciate the help!

@zhong I just updated that FAQ question with a bit more detail in case it helps 🙂

thanks for the clarification! One more question (sorry), is the config found locally on each endpoint that is connected to fleet?

Ah, so that flag is configured on the Fleet server. You can also configure the

--host_identifier

in osquery on the endpoints themselves, but most folks find it easier to just modify the Fleet server config.

@zwass sorry for being inactive the past few days. Just wanted to follow up some more on this and double-check. If i wanted to update the config file for all hosts connected to fleet, should i add:  

osquery:

   

host_identifier: uuid

on the Global agent options like so?

No, you need to modify it on the Fleet server as described in https://fleetdm.com/docs/deploying/configuration

So i need to run the command

fleet --osquery_host_identifier=uuid

on the fleet server?

You need to start the Fleet server with that flag set, yeah. I would put it in whatever place you configuration is currently being set (config file, environment variables, or flags)

i see, thank you for the help and for the patience with me 🤣