Attempting to select a host via the select targets...
# kolide
Attempting to select a host via the select targets dropdown and typing in the first couple of letters that start the hostname of the system, but the system doesn't seem to be popping up. I know it's online and I know it exists. I can go manually select the host from the hosts page. There are actually a number of hosts that I go to type their name out and they don't show up. Any thoughts on what could be going on here?
Can someone point me to the code responsible for
endpoint and specifically the code that does the host querying? I think I might be looking for something like
based off what I've read in
? Seems like there could be some sort of bug in play and want to understand what exactly is happening here.
Ok so I think I found it in
- where it's doing something like
, where the
is the user supplied portion of text. Running that query manually, it mimics the incorrect/missing results I see in the UI. So not entirely what is going wrong with my SQL table/database. I assume the full text index being used for the search is somehow incorrect, but my SQL knowledge is pretty limited.
Figured it out, looks to have been an artifact of how mysql configures tokens for FULLTEXT search. By default
is set to 3 and
is set to 4. In addition, the
can not be used as a token, so when I have systems named something like
, there aren't any tokens available that can be searched on and so searches fail. (Side note, typing
into the select hosts dropdown, results in a 500 error and a SQL error returned) This was also effecting the ability to search with some IP addresses, especially if your hosts use only 2 digits or less in each octet. End result, I modified
to 1 and rebuilt the FULLTEXT index on the hosts table. This results in getting the appropriate results back for all of my hosts.
Not sure what the perf impact is on setting that token size to 1, I imagine as hosts increase, your index will bloat. But I'm far far far from any sort of expert.
@Woogs excellent, I have seen this issue before, esp since most of my endpoints use dashes in the hostname. Can you document this issue on the Fleet GH?
I haven't actually contributed before, have to do a pull request to update the docs I assume? I'll have to see if I can find a good page to add this detail to
@Woogs sorry, I meant open an issue....
ahh gotcha
Yeah I can throw something into the issues when I have a chance