After upgrading to Fleetdm 4.0.1 it appears that m...
# fleet
m
After upgrading to Fleetdm 4.0.1 it appears that my hosts are logging with the uuid identifier despite my options indicating it should be the hostname:
Copy code
agent_options:
    config:
      decorators:
        load:
        - SELECT uuid AS host_uuid FROM system_info;
        - SELECT hostname AS hostname FROM system_info;
      options:
        config_tls_max_attempts: 10
        disable_distributed: false
        distributed_interval: 10
        distributed_plugin: tls
        distributed_tls_max_attempts: 10
        host_identifier: hostname
        logger_plugin: tls
        logger_tls_endpoint: /api/v1/osquery/log
        logger_tls_period: 10
        pack_delimiter: /
    overrides:
      platforms:
        windows:
          options:
            enable_powershell_events_subscriber: true
            enable_windows_events_publisher: true
            enable_windows_events_subscriber: true
r
Hmm... Can you run osquery with
--verbose --tls_dump
and look at whether Fleet is returning the appropriate configuration?
m
I'm sorry, I just sorted this out and it has nothing to do with my Fleet upgrade. I was not properly rotating my result.log and was looking at some old data. Ignore this and enjoy more important (and real) problems!