Title
#kolide
w

Woogs

12/21/2018, 6:53 PM
Attempting to select a host via the select targets dropdown and typing in the first couple of letters that start the hostname of the system, but the system doesn't seem to be popping up. I know it's online and I know it exists. I can go manually select the host from the hosts page. There are actually a number of hosts that I go to type their name out and they don't show up. Any thoughts on what could be going on here?
4:34 PM
Can someone point me to the code responsible for
/targets
endpoint and specifically the code that does the host querying? I think I might be looking for something like
SearchTargets
based off what I've read in
targets.go
? Seems like there could be some sort of bug in play and want to understand what exactly is happening here.
7:21 PM
Ok so I think I found it in
server/datastore/mysql/hosts.go
- where it's doing something like
MATCH(host_name) AGAINST('h*' IN BOOLEAN MODE)
, where the
h*
is the user supplied portion of text. Running that query manually, it mimics the incorrect/missing results I see in the UI. So not entirely what is going wrong with my SQL table/database. I assume the full text index being used for the search is somehow incorrect, but my SQL knowledge is pretty limited.
12:03 AM
Figured it out, looks to have been an artifact of how mysql configures tokens for FULLTEXT search. By default
innodb_ft_min_token_size
is set to 3 and
ft_min_word_len
is set to 4. In addition, the
-
can not be used as a token, so when I have systems named something like
fo-ba-1
, there aren't any tokens available that can be searched on and so searches fail. (Side note, typing
-
into the select hosts dropdown, results in a 500 error and a SQL error returned) This was also effecting the ability to search with some IP addresses, especially if your hosts use only 2 digits or less in each octet. End result, I modified
innodb_ft_min_token_size
to 1 and rebuilt the FULLTEXT index on the hosts table. This results in getting the appropriate results back for all of my hosts.
12:04 AM
Not sure what the perf impact is on setting that token size to 1, I imagine as hosts increase, your index will bloat. But I'm far far far from any sort of expert.
defensivedepth

defensivedepth

12/27/2018, 4:12 PM
@Woogs excellent, I have seen this issue before, esp since most of my endpoints use dashes in the hostname. Can you document this issue on the Fleet GH?
w

Woogs

12/27/2018, 6:07 PM
I haven't actually contributed before, have to do a pull request to update the docs I assume? I'll have to see if I can find a good page to add this detail to
defensivedepth

defensivedepth

12/27/2018, 6:10 PM
@Woogs sorry, I meant open an issue....
w

Woogs

12/27/2018, 6:31 PM
ahh gotcha
6:32 PM
Yeah I can throw something into the issues when I have a chance