nyanshak
03/09/2021, 9:14 PMosquery_host_identifier
is set to instance
, is there any benefit to also setting osquery_enroll_cooldown
to anything other than the default (0
)?zwass
03/09/2021, 9:20 PMnyanshak
03/09/2021, 9:21 PMosquery/plugins/remote/enroll/tls_enroll.cpp
2.8.0+
zwass
03/09/2021, 9:31 PMosquery_enroll_cooldown
is used rarely if ever now. I'm tempted to remove it entirely but it could be a good escape valve if someone ends up in that bad scenario.nyanshak
03/09/2021, 9:47 PMzwass
03/09/2021, 9:48 PMnyanshak
03/09/2021, 9:49 PMzwass
03/09/2021, 9:50 PMnyanshak
03/09/2021, 9:50 PMzwass
03/09/2021, 9:51 PMnyanshak
03/09/2021, 9:52 PM--host_identifier
, so even though fleet will have unique values for each osquery host, osquery will still send logs with hostIdentifier
set to whatever osquery specifies. So there could still be a bit of confusion when trying to correlate logs to fleet hosts, right?
And would the situation be any better if the log destination was set to fleet? I'm assuming not, because it would be processing-intensive operation to parse & rewrite all the logs.zwass
03/09/2021, 10:03 PMhostIdentifier
to identify the osquery logs (rather than some decorator value) you'll want to configure it appropriately on the clients regardless of Fleet's value.nyanshak
03/09/2021, 10:08 PMinstance
over uuid
/ why is this the recommended approach?
presumably you would never have duplicates for uuid
(except maybe if you copy the osquery DB?)zwass
03/09/2021, 10:11 PMnyanshak
03/09/2021, 10:12 PM