Hello! Thank you for continuing to support and develop Kolide Fleet! I have two problems, the cause of which I cannot understand yet. I would be grateful for your help with their solution. 1. This includes the first 3 screenshots. I try to add a specific user to the targets for a pack, but after allowing editing, I don’t see this user in the settings of a specific pack, it shows empty string. However, the general list of packs shows that the pack is installed for the user. Based on the results of my test, I see that the pack is still being applied and requests are being executed, however, this creates inconveniences during testing and debugging. What do you think is the reason for this behavior? 2. Our Fleet is configured to receive the results of queries on a schedule in the result.log file (rotation is enabled). However, today, when other queries were enabled, I noticed that they began to write to files with result-datetime.log formats, although we did not specify such settings. At the same time, while the previously included pack continued to write to the result.log file. What do you think is the reason for this behavior? This behavior was not observed before the upgrade to version 3.1.0.

2 looks like log rotation which you seem to have explicitly enabled.

Regarding the rotation, strangely, it seemed that earlier it worked differently. But thanks for the clarification! Do I understand correctly that when we turn off the rotation of logs, they will constantly be written to one file? I’ll check the errors in the JS console now.

I don't think there has been any change to log rotation. If you turn it off, logs will only be written to one file.

Yes, that’s right.

You believe this to be new behavior? From which version did you upgrade?

I cannot name the exact reason, since I have not tested requests on individual users for a long time, but only use packs. But the only big change in architecture that we have made recently is the upgrade from 2.6 to 3.1.0

If you retrieve that pack with fleetctl does it show the correct targets?

Hello Zach, I’m sorry for the delay in answering, did not work for several days due to poor health. I checked what you said, after assigning a pack to a specific host, I get a response similar to what I see in the interface in the settings for a specific pack.

Is there a hosts key just off the bottom of that screenshot?

No, I did “fleetctl get pack it-compliance” and that’s my result (attached file). In the UI I have similar situation