https://github.com/osquery/osquery logo
Title
o

OMAR

09/05/2019, 9:48 PM
while working on deploying fleet, I noticed this happens a lot with our test machines: the agent is restarted and it suddenly shows up as another asset, despite having the same name and mac address. the only difference is the IP address (one is from the office, one is from my house) is there any way to dedupe clients?
z

zwass

09/05/2019, 11:18 PM
This usually happens when osquery/Launcher is deployed in such a way that the instance restarts using a different database path. An IP changing should not cause a duplicate, because hosts are uniquely identified by their node key.
o

OMAR

09/06/2019, 7:08 PM
what's a database path? the local db that osquery uses for snapshotting etc?
test machines are running like this:
launcher --hostname fleet.random.etc:8080 --enroll_secret secret12345
z

zwass

09/06/2019, 7:14 PM
Yep, that explains it. If you don't specify
--root_directory
Launcher will create a new temp path each time it starts.
o

OMAR

09/06/2019, 7:15 PM
ha, okay! thank you