i don’t think this is a problem because osquery could also start when the host is offline
06/06/2018, 10:03 AM
sorry for my english. either i couldn’t describe the situation or you didn’t understand. I can’t understand that why it is not considered?
1-the fleet server is off
2- I newly installed a windows (which never added to fleet before)
3- I installed osquery on that computer,configured the flag file and restarted osqueryd service
4- I started the fleet server but despite the passing minutes the host never been added to the fleet
in this situation, is what you say that the agent/host will never be added to the fleet until the osqueryd service restart?
in other word, in such situation osqueryd service must be restarted after the fleet started. That may not be an appropriate approach
I will another test for this case and will let you.. thanks the support