Here are some notes from that conversation:
Status Quo (host_identifier=uuid)
- Works until hosts have the same UUID. Seems to be an issue in your (current) environment.
- Not viable in your (current) environment due to hosts overwriting enrollment.
host_identifier=instance
- A new, osquery-specific UUID will be generated and stored in the osquery DB for each host
- Works until a VM image is copied with the osquery DB already initialized (though host_identifier=uuid will fail in the same way)
- Changing this now will cause Fleet to see every host as a fresh enrollment, leading to a single duplicate for each host in Fleet. The duplicates will have to be cleaned up later (though this can be automated with the host_expiry setting in Fleet).
Redeploy offending hosts with properly reset UUIDs
- No idea if this is viable for your situation, but if the duplicate issue described above seems worse than doing this, it is worth considering