https://github.com/osquery/osquery logo
Title
r

RPuth

11/15/2018, 3:52 PM
Is there a fleetctl command, or a way using the GUI to drop multiple offline hosts at a time as a form of cleanup?
t

Tim

04/29/2019, 7:29 PM
Did you ever get something for this working? I'm having some trouble trying to do this exact thing.
r

RPuth

04/29/2019, 8:01 PM
Hi there, it was a little ago but I think I remember writing a script that did it. At the time I was running around 20k hosts with randomized names for some testing, and using some simple regex with command line arguments (if I remember correctly) to remove them quickly seemed to do the trick. I haven't taken a look at Kolide since December so I'm unsure if they have updated this yet with an easier method.
t

Tim

04/29/2019, 8:32 PM
Thanks for the reply. I've been looking at kolide and can't find a simple way to do this still. Fleetctl has a delete cmd now but pulling the offline hosts in a yaml format is proving to be troublesome too. Were you doing api calls outside of fleetctl? if so, how did you get around the authentication required? Thanks for any help you can give me
r

RPuth

04/30/2019, 7:05 PM
Sorry, It was about 5 months ago and I don't have much on me at hand with regards to this. Regarding an efficient way to do this, I don't remember there being one off the top of my head. As I said previous, I believe I created a script - maybe bash? - that did the removal for me. Sorry that I can't be of more help
t

Tim

04/30/2019, 8:06 PM
Thanks for responding. I'll keep poking around. Thanks for the input.