https://github.com/osquery/osquery logo
Join Slack
Powered by
Hi Team, When I am trying to change Osquery option...
# fleet
a
Hi Team, When I am trying to change Osquery option like distributed_interval from Fleet GUI, I was expecting the new config will be read by the osquery endpoints whenever those reach out to fleet. But I am observing all the Osquery endpoints re-enrolling making the fleet go down few times before everything settles down. Is this the expected behaviour, is there a way I could avoid the re-enroll and downtime?
k
Hi @Anoop K V! What version of Fleet are you running? Can you share a little of what's going on in the logs when Fleet is going down?
a
Hi @Kathy Satterlee, We are running Fleet 3.11 on AWS. Attached is the snapshot of CPU and Memory during the change and logs seen during the time.
l
Hi @Anoop K V We strongly encourage to upgrade to latest version of Fleet (4.24.1), Fleet 3.X is not supported anymore.
a
@Lucas Rodriguez Thanks. Has there been any feature/fixes came in the latest version that would help us here? So that I could push for an upgrade as the setup is in production.
l
Hi @Anoop K V. Since 3.11? a whole lot of new features additions and performance improvements (3.11.0 is more than one and a half years old). We strongly recommend to upgrade to latest 👍
Forgot to mention some features (apart from bug fixes and performance improvements), to name a few: 1. Policy queries and automation (to notify endpoints or create tickets when there's a policy failure). 2. Software inventory and vulnerability processing (also with automation to notify admins of vulnerabilities in their devices). 3. Fleet Desktop 4. New Role-based access control (RBAC) and Teams (premium) features. You can take a look at release notes for all versions in: https://github.com/fleetdm/fleet/releases
@Anoop K V 👆
a
Thanks @Lucas Rodriguez
Open in Slack
PreviousNext
Powered by