Attempting to select a host via the select targets...
# kolide
w
Attempting to select a host via the select targets dropdown and typing in the first couple of letters that start the hostname of the system, but the system doesn't seem to be popping up. I know it's online and I know it exists. I can go manually select the host from the hosts page. There are actually a number of hosts that I go to type their name out and they don't show up. Any thoughts on what could be going on here?
Can someone point me to the code responsible for
/targets
endpoint and specifically the code that does the host querying? I think I might be looking for something like
SearchTargets
based off what I've read in
targets.go
? Seems like there could be some sort of bug in play and want to understand what exactly is happening here.
Ok so I think I found it in
server/datastore/mysql/hosts.go
- where it's doing something like
MATCH(host_name) AGAINST('h*' IN BOOLEAN MODE)
, where the
h*
is the user supplied portion of text. Running that query manually, it mimics the incorrect/missing results I see in the UI. So not entirely what is going wrong with my SQL table/database. I assume the full text index being used for the search is somehow incorrect, but my SQL knowledge is pretty limited.
Figured it out, looks to have been an artifact of how mysql configures tokens for FULLTEXT search. By default
innodb_ft_min_token_size
is set to 3 and
ft_min_word_len
is set to 4. In addition, the
-
can not be used as a token, so when I have systems named something like
fo-ba-1
, there aren't any tokens available that can be searched on and so searches fail. (Side note, typing
-
into the select hosts dropdown, results in a 500 error and a SQL error returned) This was also effecting the ability to search with some IP addresses, especially if your hosts use only 2 digits or less in each octet. End result, I modified
innodb_ft_min_token_size
to 1 and rebuilt the FULLTEXT index on the hosts table. This results in getting the appropriate results back for all of my hosts.
Not sure what the perf impact is on setting that token size to 1, I imagine as hosts increase, your index will bloat. But I'm far far far from any sort of expert.
d
@Woogs excellent, I have seen this issue before, esp since most of my endpoints use dashes in the hostname. Can you document this issue on the Fleet GH?
w
I haven't actually contributed before, have to do a pull request to update the docs I assume? I'll have to see if I can find a good page to add this detail to
d
@Woogs sorry, I meant open an issue....
w
ahh gotcha
Yeah I can throw something into the issues when I have a chance