Cristhian Amaya
08/12/2020, 3:16 PMenroll
endpoint so I don't see them in the Kolide UI, but those hosts read the config from Kolide just fine and also send logs without any issues.
The installation is the same on many hosts and this behaviour only happens on some of them.
I've tried using the --tls_dump --verbose
flags to see if there was any pointer, but I didn't see any, there's no info about enrollment
Any ideas?--enroll_always
on one of the machines and it was enrolled correctly, yay!
The flag is not documented and I found it here https://github.com/osquery/osquery/pull/2827/files
Does anyone have any info about the implications of having that flag permanently?terracatta
Cristhian Amaya
08/12/2020, 4:25 PMterracatta
seph
Cristhian Amaya
08/13/2020, 12:30 PM--enroll_always
flag enabled if you have stable host identifiers as @terracatta pointed out. If a host already exists on
Kolide and there's a new enrollment request, Kolide justs updates the
node_key: https://github.com/kolide/fleet/blob/7494513400b1d15d3e770358350d227ffbe2e4ce/server/datastore/mysql/hosts.go#L231
For background context in case it helps someone: Our problem is that some hosts are being built based on images where osquery was already installed and enrolled so all of them had the same node_key which means that the enrollment process was never executed.
And the last reference because I didn't find an answer on the internet, this is how I read the node_key on a host:
grep -l 'nodeKey' /var/osquery/osquery.db/*.sst
strings /var/osquery/osquery.db/{FILE_NAME}.sst | grep nodeKey -A 1
terracatta
Cristhian Amaya
08/13/2020, 12:33 PMJulian Scala
08/14/2020, 7:55 PMstable
host identifier? We specify the host identifier to our own UUID on every host. Does that means stable?Cristhian Amaya
08/18/2020, 9:01 AMJulian Scala
08/18/2020, 12:56 PM