. This is more of an osquery thing than fleet thing but mentioning here because I see some possibly related discussion in history. But I didn't find any resolution in the threads I found. All this testing/mucking around was done on ubuntu18.04. We do our localhost line in /etc/hosts file like this
- pretty standard stuff... But this seems to cause osquery to choose the first entry
127.0.0.1 localhost <hostname_here>
in /etc/hosts localhost line as hostname of record. If I switch /etc/hosts localhost line to
osquery picks up <hostname_here> as desired, but this is wrong and mucks lot of things that rely on localhost line being valid. If I remove <hostname_here> from /etc/hosts it appears that osquery concatenates hostname from /etc/hostname and possibly the domain line in /etc/resolv.conf. If I change the domain line in /etc/resolv.conf to something invalid or remove the domain line I get what I expected in fleet. I don't mind the domain being concatenated with the hostname just seems odd. Would like to be able to configure this behavior.
127.0.0.1 <hostname_here> localhost
the value you expect?
select hostname, local_hostname, computer_name from osquery_info