Hello, a new user here experimenting with Kolide and fleetctl in the last few weeks. Have a quick question on how one could query OFFLINE hosts with fleetctl. Is there a good way with fleetctl to get a list of offline hosts? what would be the query look like? Because when you login to UI, you can see ONLINE, OFFLINE, MIA, NEW hosts. I am thinking there is some kind of a query Kolide does to fetch all of these... What is the proper way of doing this through fleetctl ? How about MIA ones ?

unfortunately

fleetctl

doesn't provide the ability to list devices, offline or otherwise.

I see, so how does kolide ui list those? Is not there some kind of a query it is doing when listing OFFLINE hosts ?

Yep the devices are stored in the mysql db, but the functionality for listing those just hasn't been implemented in fleetctl. It'd definitely possible to add that ability though

ok, do you know which table in mysql would that be by any chance? Also, what can I do to get this functionality added to fleetctl? is there a way for me to do a request for this ?

You can open an issue at github.com/kolide/fleet/issues/new, and I believe the devices are stored in the

hosts

table

ok great! thank you so much!

no problem!

If you don't mind making requests directly to an API endpoint, you could use

/api/v1/kolide/host_summary

which returns those counts. It doesn't return a list of systems, just the counts though

is there an api call I can make to list all of the hosts that are in OFFLINE/ONLINE/MIA state instead of just getting the counts ?

I believe

/api/v1/kolide/hosts

will give you a list of all your hosts and one of the fields returned per host is status/state