Hello Fleet. We've been seeing a lot of hosts failing to enroll "save enroll failed: host identified by 49D6166F....... enrolling too often" and I saw https://github.com/fleetdm/fleet/issues/577. Looks like that person's issue was related to deploying VMs that already had osquery installed, so their issue was duplicate uuids. We aren't having that problem, and on the hosts I've checked the uuid I see in Fleet matches the one on the client, but we still see the errors. It looks like they fail for a while then start working (uuid doesn't change). We just upgraded to 3.9.0 and I know there's something with the enrollment cooldown was updated in 3.9. Is this the kind of thing 3.9 may address? any guidance on what could be causing this given that the uuids aren't mismatched / changing?

Do all of the errors have that same identifier? To be clear, the issue can take place when multiple hosts have the same hardware UUID which seems to happen in some environments when cloning VMs. It is not necessary that osquery was installed on the host before the VM was copied.

Thanks @zwass - no, not all are the same...they are just the same to a given host that has problems but then starts working. So far I've seen it on laptops and VMs. will keep digging

Maybe because we switched the cooldown to default to off. Seemed some folks were running into trouble with it.

ack, thanks Zach. I new something in 3.9 was supposed to make that better