https://github.com/osquery/osquery logo
#kolide
Title
# kolide
d

drende

11/27/2018, 12:07 AM
Hello, a new user here experimenting with Kolide and fleetctl in the last few weeks. Have a quick question on how one could query OFFLINE hosts with fleetctl. Is there a good way with fleetctl to get a list of offline hosts? what would be the query look like? Because when you login to UI, you can see ONLINE, OFFLINE, MIA, NEW hosts. I am thinking there is some kind of a query Kolide does to fetch all of these... What is the proper way of doing this through fleetctl ? How about MIA ones ?
b

blaedj

11/27/2018, 4:19 PM
unfortunately
fleetctl
doesn't provide the ability to list devices, offline or otherwise.
d

drende

11/27/2018, 4:43 PM
I see, so how does kolide ui list those? Is not there some kind of a query it is doing when listing OFFLINE hosts ?
b

blaedj

11/27/2018, 6:37 PM
Yep the devices are stored in the mysql db, but the functionality for listing those just hasn't been implemented in fleetctl. It'd definitely possible to add that ability though
d

drende

11/27/2018, 9:39 PM
ok, do you know which table in mysql would that be by any chance? Also, what can I do to get this functionality added to fleetctl? is there a way for me to do a request for this ?
b

blaedj

11/28/2018, 11:44 AM
You can open an issue at github.com/kolide/fleet/issues/new, and I believe the devices are stored in the
hosts
table
d

drende

11/28/2018, 4:38 PM
ok great! thank you so much!
b

blaedj

11/28/2018, 5:54 PM
no problem!
w

Woogs

11/28/2018, 6:15 PM
If you don't mind making requests directly to an API endpoint, you could use
/api/v1/kolide/host_summary
which returns those counts. It doesn't return a list of systems, just the counts though
d

drende

11/28/2018, 7:26 PM
is there an api call I can make to list all of the hosts that are in OFFLINE/ONLINE/MIA state instead of just getting the counts ?
w

Woogs

11/28/2018, 9:20 PM
I believe
/api/v1/kolide/hosts
will give you a list of all your hosts and one of the fields returned per host is status/state