Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hi fleet team, we found out we miss a small portion of our hosts in fleet, maybe could u help to explain what is the possible reason can make it happened?

This may be related to this issue:

<https://github.com/fleetdm/fleet/issues/9132|https://github.com/fleetdm/fleet/issues/9132>

Do you have access to the Fleet database? If so, run the following query for me:

```select * from hosts where orbit_node_key = NULL```
I anticipate that you’ll see a similar number of results. If you do, it would be nice to see what those hosts have in common. 

well, that is weird, because we dont have orbit installed but osquery installed directly.

Interesting. What are you using as your host identifier?

And what versions of Fleet and osquery are you working with? 

And are you seeing any errors in the Fleet logs? 

i didn't cfg for host identifier specifically.

so think it is supposed to use host name?

and we even cannot find it from local query by osqueryi.

Are you saying that the query doesn't return results locally via osqueryi either? Sounds like it might be an osquery bug

yes. we run the same query on the host, but also empty return.

In that case I think it's likely that osquery can't get the serial. What kind of device is this?

Maybe let's open a new thread in <#C08V7KTJB|general>?