Hello everyone! I'm having a little problem regard...
# fleet
Hello everyone! I'm having a little problem regarding OSQuery for MacOS: some hosts keep "rejoining" Fleet with different hostnames (sometimes even with the same hostname) and I have no idea why. Note in the screenshot that it is the same machine, based on the serial number
Perhaps the solution is to group machines by serial number? What do you think?
Hi, @Saulo Guilhermino! What are you using as your host identifier?
Hey @Kathy Satterlee, my OSQuery flag file sets the
Was osquery removed or the database wiped in between hostname changes? If the hostname changed and then osquery sent an enrollment request, Fleet would see this as a new device.
I see that they all checked in in relatively short periods, so perhaps there was an issue with that machine that resulted in some tinkering?
If you remove the duplicates in Fleet, do they pop back up?
Yeah, it likely has to do with the different hostnames. Is there something on the machine that could actually be changing the hostname? I suspect you could solve this by switching to
Hi, sorry for the delay. @Kathy Satterlee There were no changes to the osquery installation or the database in this time period, as you guessed it. I already removed the duplicates yesterday, but they keep showing up. @zwass I do think something on the machine is causing the hostname to change, but I'm not sure what it could be. I will try to switch the identifier and send updates here if I notice any changes. Thanks for the suggestions!
Sounds good. @Saulo Guilhermino!
If you wouldn't mind sharing your
flags as well, I may be able to find something there.
Sure! Here it is:
Copy code
--enroll_secret_path=<%= @secret_path %>
--tls_hostname=<%= @fleet_url %>
I just notice that all machines are rejoining, so I deleted all of them and now i'm waiting a little bit to get a new hosts list
Hey! Just to update you: the issue seems to be solved after the
switch. I have no duplicate hosts until now, thanks again!
That’s awesome, glad to hear it!