https://github.com/osquery/osquery logo
#fleet
Title
# fleet
s

Saulo Guilhermino

10/26/2022, 1:35 PM
Hello everyone! I'm having a little problem regarding OSQuery for MacOS: some hosts keep "rejoining" Fleet with different hostnames (sometimes even with the same hostname) and I have no idea why. Note in the screenshot that it is the same machine, based on the serial number
Perhaps the solution is to group machines by serial number? What do you think?
k

Kathy Satterlee

10/26/2022, 2:35 PM
Hi, @Saulo Guilhermino! What are you using as your host identifier?
s

Saulo Guilhermino

10/26/2022, 2:37 PM
Hey @Kathy Satterlee, my OSQuery flag file sets the
hostname
as
host_identifier
k

Kathy Satterlee

10/26/2022, 3:02 PM
Was osquery removed or the database wiped in between hostname changes? If the hostname changed and then osquery sent an enrollment request, Fleet would see this as a new device.
I see that they all checked in in relatively short periods, so perhaps there was an issue with that machine that resulted in some tinkering?
If you remove the duplicates in Fleet, do they pop back up?
z

zwass

10/26/2022, 3:42 PM
Yeah, it likely has to do with the different hostnames. Is there something on the machine that could actually be changing the hostname? I suspect you could solve this by switching to
uuid
for
host_identifier
.
s

Saulo Guilhermino

10/26/2022, 4:58 PM
Hi, sorry for the delay. @Kathy Satterlee There were no changes to the osquery installation or the database in this time period, as you guessed it. I already removed the duplicates yesterday, but they keep showing up. @zwass I do think something on the machine is causing the hostname to change, but I'm not sure what it could be. I will try to switch the identifier and send updates here if I notice any changes. Thanks for the suggestions!
k

Kathy Satterlee

10/26/2022, 4:59 PM
Sounds good. @Saulo Guilhermino!
If you wouldn't mind sharing your
osquery
flags as well, I may be able to find something there.
s

Saulo Guilhermino

10/26/2022, 7:41 PM
Sure! Here it is:
Copy code
--enroll_secret_path=<%= @secret_path %>
--tls_hostname=<%= @fleet_url %>
--host_identifier=uuid
--enroll_tls_endpoint=/api/osquery/enroll
--config_plugin=tls
--config_tls_endpoint=/api/osquery/config
--config_refresh=10
--disable_distributed=false
--distributed_plugin=tls
--distributed_interval=10
--distributed_tls_max_attempts=3
--distributed_tls_read_endpoint=/api/osquery/distributed/read
--distributed_tls_write_endpoint=/api/osquery/distributed/write
--logger_plugin=tls
--logger_tls_endpoint=/api/osquery/log
--logger_tls_period=10
I just notice that all machines are rejoining, so I deleted all of them and now i'm waiting a little bit to get a new hosts list
Hey! Just to update you: the issue seems to be solved after the
host_identifier
switch. I have no duplicate hosts until now, thanks again!
k

Kathy Satterlee

10/31/2022, 1:56 PM
That’s awesome, glad to hear it!