Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hello. I've installed osquery on one my host, i'm seeing tracking from the host to fleet host but fleet is not enrolling it. Any way to debug it?

I'm seeing incoming traffic with tcpdump but no logs or enrollment of the host

Check out <https://github.com/fleetdm/fleet/blob/master/docs/2-Deployment/FAQ.md#why-arent-my-osquery-agents-connecting-to-fleet|https://github.com/fleetdm/fleet/blob/master/docs/2-Deployment/FAQ.md#why-arent-my-osquery-agents-connecting-to-fleet>

I build my clients with kolide launcher, can i set those osquery flags on build?

Ah, I'm not sure. Maybe there's a verbose or debug flag?

Yeah, i can set up those flags with kolide launcher. But how i debug it? Seeing fleet logs?

I didn't mentioned it but i have no access to the prod machine that is not enrolling

Typically debugging enrollment requires access to the host since we can't get the logs into Fleet until the host successfully enrolls