Channels
android_tests
apple-silicon
arm-architecture
auditing-warroom
aws
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
general
golang
goquery
infrastructure
jobs
kolide
linen-dev
linux
macos
officehours
osctrl
plugins
process-auditing
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Title
h
harveywells
07/16/2020, 4:06 PM👋 Trying to debug an issue and I'm curious if anyone else has encountered it here — we have a group of linux endpoints that were enrolled in Fleet previously but are no longer visible in the UI or reachable via fleetcl . My theory is that this may be related to the "automatic host expiry" option enabled but the "last seen time" for one of the hosts is yesterday; our expiry window much larger than 24 hrs 😛 . How does Kolide determine "last seen time"?
z
zwass
07/16/2020, 4:22 PMAny time the host makes a request to Fleet the seen time is updated.
Even if a host is "expired" by not checking in for the period, if osqueryd runs with the appropriate configuration (enroll secret) it will just re-enroll.
h
harveywells
07/16/2020, 4:23 PMhuh
z
zwass
07/16/2020, 4:23 PMThese hosts are still in the DB?
h
harveywells
07/16/2020, 4:25 PMI haven't hopped onto the DB instance yet, I was trying to reach the host via
fleetctlz
zwass
07/16/2020, 4:25 PMDoes the host show up in
fleetctl get hostsHow do you know what the last seen time is if the hosts don't show up?
h
harveywells
07/16/2020, 4:26 PMWe ingest Fleet server logs into BigQuery
z
zwass
07/16/2020, 4:26 PMSo you saw a server log indicating that host made a request?
h
harveywells
07/16/2020, 4:27 PMwe have a log line that show the host was online yesterday and it's last_seen_time was also yesterday
I was also expecting the nodes to re-enroll as well. I was able re-enroll it by supplying the config + enroll endpoint flags from the command line.
z
zwass
07/16/2020, 4:41 PMWhere did you see the
last_seen_timeh
harveywells
07/16/2020, 4:43 PMSorry let my clarify. I didn't interface with the DB directly. We are ingesting the db data into GCP's BigQuery and I was able to see the last_seen_time and online status there.
z
zwass
07/16/2020, 4:50 PMAh, I see. Would be interesting to know if the entry is in the DB. If so, there's no reason it should not be available through the UI/fleetctl.
🍻 1