https://github.com/osquery/osquery logo
Title
a

Anoop K V

12/17/2022, 10:10 AM
Hi Team, When I am trying to change Osquery option like distributed_interval from Fleet GUI, I was expecting the new config will be read by the osquery endpoints whenever those reach out to fleet. But I am observing all the Osquery endpoints re-enrolling making the fleet go down few times before everything settles down. Is this the expected behaviour, is there a way I could avoid the re-enroll and downtime?
k

Kathy Satterlee

12/19/2022, 4:44 PM
Hi @Anoop K V! What version of Fleet are you running? Can you share a little of what's going on in the logs when Fleet is going down?
a

Anoop K V

12/20/2022, 8:58 AM
Hi @Kathy Satterlee, We are running Fleet 3.11 on AWS. Attached is the snapshot of CPU and Memory during the change and logs seen during the time.
l

Lucas Rodriguez

12/21/2022, 7:22 PM
Hi @Anoop K V We strongly encourage to upgrade to latest version of Fleet (4.24.1), Fleet 3.X is not supported anymore.
a

Anoop K V

12/23/2022, 9:45 AM
@Lucas Rodriguez Thanks. Has there been any feature/fixes came in the latest version that would help us here? So that I could push for an upgrade as the setup is in production.
l

Lucas Rodriguez

12/23/2022, 3:54 PM
Hi @Anoop K V. Since 3.11? a whole lot of new features additions and performance improvements (3.11.0 is more than one and a half years old). We strongly recommend to upgrade to latest 👍
Forgot to mention some features (apart from bug fixes and performance improvements), to name a few: 1. Policy queries and automation (to notify endpoints or create tickets when there's a policy failure). 2. Software inventory and vulnerability processing (also with automation to notify admins of vulnerabilities in their devices). 3. Fleet Desktop 4. New Role-based access control (RBAC) and Teams (premium) features. You can take a look at release notes for all versions in: https://github.com/fleetdm/fleet/releases
@Anoop K V 👆
a

Anoop K V

01/02/2023, 2:08 PM
Thanks @Lucas Rodriguez