Pete Johnson

11/05/2019, 5:02 PM
Question for some Kolide / osquery experts out there. We're enrolling some Mac's into Kolide Fleet and we're seeing some sporadic results in how the host_identifier is being reported to Fleet. We're using osquery 4.0.2. Sometimes machines that are enrolled send up the proper hostname value for the machine, other times we're seeing "localhost" in Fleet. When I run
select * from system_info;
locally on one of the endpoints that are showing up as "localhost" in Fleet, osquery is actually populating the hostname field with "localhost". So I believe Fleet is just reporting (properly) what osquery is telling it. On the same machine when I run hostname (outside of osquery), I'm getting the correct results (gives me the computer name). Anyone else have this issue with the "hostname" field not actually populating correctly with the hostname of the machine?
5:02 PM


11/08/2019, 11:06 PM
are those systems being provisioned at the same time when they enroll in kolide? i think i've seen this before, may it be a race condition due to the system finish the enrollment process before the hostname is set at system level?