Dan Achin03/15/2021, 7:49 PM
We still have the following in osquery.flags
I'm seeing some strange stuff in this test environment. The hosts will register to fleet, but if you refresh fleet UI, every 10 - 15 seconds or so the hosts will flap between offline and online. Additionally, we aren't logging ANY query results at fleet for these nodes even though we have a few simple ones scheduled. When I run osquery in debug on these nodes, I see the registration, but no decorators, options, packs or queries. I tried adding back in config_plugin=tls and then started to get a bunch of errors about enrolling too often.
Dan Achin03/16/2021, 12:13 AM