Bryan Brewer
06/30/2020, 10:52 PMlocalhost
. This is more of an osquery thing than fleet thing but mentioning here because I see some possibly related discussion in history. But I didn't find any resolution in the threads I found.
All this testing/mucking around was done on ubuntu18.04.
We do our localhost line in /etc/hosts file like this 127.0.0.1 localhost <hostname_here>
- pretty standard stuff... But this seems to cause osquery to choose the first entry localhost
in /etc/hosts localhost line as hostname of record.
If I switch /etc/hosts localhost line to 127.0.0.1 <hostname_here> localhost
osquery picks up <hostname_here> as desired, but this is wrong and mucks lot of things that rely on localhost line being valid.
If I remove <hostname_here> from /etc/hosts it appears that osquery concatenates hostname from /etc/hostname and possibly the domain line in /etc/resolv.conf. If I change the domain line in /etc/resolv.conf to something invalid or remove the domain line I get what I expected in fleet. I don't mind the domain being concatenated with the hostname just seems odd. Would like to be able to configure this behavior.zwass
select hostname, local_hostname, computer_name from osquery_info
the value you expect?Bryan Brewer
06/30/2020, 10:57 PMzwass