https://github.com/osquery/osquery logo
Title
w

wennan.he

02/10/2023, 10:49 PM
Hi fleet team, we found out we miss a small portion of our hosts in fleet, maybe could u help to explain what is the possible reason can make it happened?
k

Kathy Satterlee

02/10/2023, 11:00 PM
This may be related to this issue: https://github.com/fleetdm/fleet/issues/9132 Do you have access to the Fleet database? If so, run the following query for me:
select * from hosts where orbit_node_key = NULL
I anticipate that you’ll see a similar number of results. If you do, it would be nice to see what those hosts have in common.
w

wennan.he

02/10/2023, 11:05 PM
well, that is weird, because we dont have orbit installed but osquery installed directly.
k

Kathy Satterlee

02/10/2023, 11:06 PM
Interesting. What are you using as your host identifier?
And what versions of Fleet and osquery are you working with?
And are you seeing any errors in the Fleet logs?
w

wennan.he

02/10/2023, 11:54 PM
osquery 5.4.0
fleet version 4.20.1
i didn't cfg for host identifier specifically.
so think it is supposed to use host name?
and i didn't see any err log.
and we even cannot find it from local query by osqueryi.
z

zwass

02/11/2023, 12:20 AM
Are you saying that the query doesn't return results locally via osqueryi either? Sounds like it might be an osquery bug
w

wennan.he

02/11/2023, 12:21 AM
yes. we run the same query on the host, but also empty return.
z

zwass

02/11/2023, 12:22 AM
In that case I think it's likely that osquery can't get the serial. What kind of device is this?
w

wennan.he

02/11/2023, 12:22 AM
bmvm
nothing special
z

zwass

02/11/2023, 12:25 AM
I'm not familiar with bmvm.
Maybe let's open a new thread in #general?
w

wennan.he

02/11/2023, 12:26 AM
gonna to doing it, thx.