mirror of
https://github.com/empayre/fleet.git
synced 2024-11-06 08:55:24 +00:00
Weekly community-driven documentation update for week ending March 25th (#4818)
* Weekly community-driven docs update for week ending March 25th * Update Configuration.md * Update FAQ.md All edits are recorded by line: 192 added “-“ to “auto-updates” 194 added “-“ to “auto-updates”; deleted “,” after “(easy)”; replaced “reccomend” with “recommend” 209 added “,” after “work” 211 replaced “am I seeing” with “do I see” 225 replaced “The best way to maintain historical data currently would be to use the [REST API](./REST-API.md) or the [`fleetctl` CLI](./fleetctl-CLI.md) to manually retrieve and save the data you need on your schedule. “ with “Currently, Fleet only stores the current state of your hosts (when they last communicated with Fleet). The best way at the moment to maintain historical data would be to use the [REST API](./REST-API.md) or the [`fleetctl` CLI](./fleetctl-CLI.md) to retrieve it manually. Then save the data you need to your schedule.” * Update FAQ.md All edits are recorded by line: 194 deleted ”either” after “disabled” * Update fleetctl-CLI.md All edits are recorded by line: 28 deleted “of the” after “many”; replaced “User Interface” with “UI(User Interface)”; replace “, and to” with “. You can even” 43 capitalized “Fleet” 63 replaced “info” with “information” * Additional context for help menu and add table Tweaked wording around using the help command and moved available commands in to a table. @DominusKelvin @Desmi-Dizney * Update Configuration.md space * Final grammar revision Co-authored-by: Desmi-Dizney <99777687+Desmi-Dizney@users.noreply.github.com>
This commit is contained in:
parent
e483821f91
commit
d3454bcfce
@ -47,7 +47,7 @@ The `fleet` binary contains several "commands". Similarly to how `git` has many
|
||||
- `fleet prepare db`
|
||||
- `fleet serve`
|
||||
- `fleet version`
|
||||
- `fleet config_dump`
|
||||
- `fleet config_dump`
|
||||
|
||||
### Options
|
||||
|
||||
@ -89,10 +89,11 @@ FLEET_LOGGING_JSON=true \
|
||||
/usr/bin/fleet serve
|
||||
```
|
||||
|
||||
##### Using a config file
|
||||
##### Using a YAML config file
|
||||
|
||||
```
|
||||
echo '
|
||||
|
||||
mysql:
|
||||
address: 127.0.0.1:3306
|
||||
database: fleet
|
||||
@ -109,6 +110,8 @@ logging:
|
||||
fleet serve --config /tmp/fleet.yml
|
||||
```
|
||||
|
||||
For more information on using YAML configuration files with fleet, please see the [configuration files](../Using-Fleet/configuration-files/README.md) documentation.
|
||||
|
||||
### What are the options?
|
||||
|
||||
Note that all option names can be converted consistently from flag name to environment variable and visa-versa. For example, the `--mysql_address` flag would be the `FLEET_MYSQL_ADDRESS`. Further, specifying the `mysql_address` option in the config would follow the pattern:
|
||||
@ -131,7 +134,7 @@ All duration-based settings accept valid time units of `s`, `m`, `h`.
|
||||
|
||||
#### MySQL
|
||||
|
||||
This section describes the configuration options for the primary - if you also want to setup a read replica, the options are the same, except that the yaml section is `mysql_read_replica`, and the flags have the `mysql_read_replica_` prefix instead of `mysql_` (the corresponding environment variables follow the same transformation). Note that there is no default value for `mysql_read_replica_address`, it must be set explicitly for fleet to use a read replica, and it is recommended in that case to set a non-zero value for `mysql_read_replica_conn_max_lifetime` as in some environments, the replica's address may dynamically change to point
|
||||
This section describes the configuration options for the primary - if you also want to setup a read replica, the options are the same, except that the yaml section is `mysql_read_replica`, and the flags have the `mysql_read_replica_` prefix instead of `mysql_` (the corresponding environment variables follow the same transformation). Note that there is no default value for `mysql_read_replica_address`, it must be set explicitly for Fleet to use a read replica, and it is recommended in that case to set a non-zero value for `mysql_read_replica_conn_max_lifetime` as in some environments, the replica's address may dynamically change to point
|
||||
from the primary to an actual distinct replica based on auto-scaling options, so existing idle connections need to be recycled
|
||||
periodically.
|
||||
|
||||
@ -304,6 +307,21 @@ Maximum amount of time, in seconds, a connection may be reused.
|
||||
conn_max_lifetime: 50
|
||||
```
|
||||
|
||||
##### Example YAML
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: config
|
||||
spec:
|
||||
msyql:
|
||||
address: localhost:3306
|
||||
database: fleet
|
||||
password: fleet
|
||||
max_open_conns: 50
|
||||
max_idle_conns: 50
|
||||
conn_max_lifetime: 50
|
||||
```
|
||||
|
||||
#### Redis
|
||||
|
||||
Note that a TLS connection to a Redis instance can be tested by running the
|
||||
@ -614,7 +632,21 @@ A value of 0 means no timeout.
|
||||
write_timeout: 5s
|
||||
```
|
||||
|
||||
#### Server
|
||||
##### Example YAML
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: config
|
||||
spec:
|
||||
redis:
|
||||
address: localhost:7369
|
||||
password: foobar
|
||||
database: 14
|
||||
connect_timeout: 10s
|
||||
connect_retry_attempts: 2
|
||||
```
|
||||
|
||||
### Server
|
||||
|
||||
##### server_address
|
||||
|
||||
@ -713,6 +745,20 @@ Turning off keepalives has helped reduce outstanding TCP connections in some dep
|
||||
keepalive: true
|
||||
```
|
||||
|
||||
##### Example YAML
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: config
|
||||
spec:
|
||||
server:
|
||||
address: 0.0.0.0:443
|
||||
password: foobar
|
||||
cert: /tmp/fleet.crt
|
||||
key: /tmp/fleet.key
|
||||
invite_token_validity_period: 1d
|
||||
```
|
||||
|
||||
#### Auth
|
||||
|
||||
##### auth_bcrypt_cost
|
||||
@ -741,6 +787,17 @@ The key size of the salt which is generated when hashing user passwords.
|
||||
salt_key_size: 36
|
||||
```
|
||||
|
||||
##### Example YAML
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: config
|
||||
spec:
|
||||
auth:
|
||||
bcrypt_cost: 14
|
||||
salt_key_size: 36
|
||||
```
|
||||
|
||||
#### App
|
||||
|
||||
##### app_token_key_size
|
||||
@ -782,6 +839,18 @@ Determines whether Fleet gets scheduled query statistics from hosts or not.
|
||||
enable_scheduled_query_stats: true
|
||||
```
|
||||
|
||||
##### Example YAML
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: config
|
||||
spec:
|
||||
app:
|
||||
token_key_size: 36
|
||||
salt_key_size: 36
|
||||
invite_token_validity_period: 1d
|
||||
```
|
||||
|
||||
#### License
|
||||
|
||||
##### license_key
|
||||
@ -797,6 +866,16 @@ The license key provided to Fleet customers which provides access to Fleet Premi
|
||||
key: foobar
|
||||
```
|
||||
|
||||
##### Example YAML
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: config
|
||||
spec:
|
||||
license:
|
||||
key: foobar
|
||||
```
|
||||
|
||||
#### Session
|
||||
|
||||
##### session_key_size
|
||||
@ -827,6 +906,16 @@ Valid time units are `s`, `m`, `h`.
|
||||
duration: 4h
|
||||
```
|
||||
|
||||
##### Example YAML
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: config
|
||||
spec:
|
||||
session:
|
||||
duration: 4h
|
||||
```
|
||||
|
||||
#### Osquery
|
||||
|
||||
##### osquery_node_key_size
|
||||
@ -965,7 +1054,7 @@ Given an update interval (label, or details), this will add up to the defined pe
|
||||
The goal of this is to prevent all hosts from checking in with data at the same time.
|
||||
|
||||
So for example, if the label_update_interval is 1h, and this is set to 10. It'll add up a random number between 0 and 6 minutes
|
||||
to the amount of time it takes for fleet to give the host the label queries.
|
||||
to the amount of time it takes for Fleet to give the host the label queries.
|
||||
|
||||
- Default value: `10`
|
||||
- Environment variable: `FLEET_OSQUERY_MAX_JITTER_PERCENT`
|
||||
@ -978,7 +1067,7 @@ to the amount of time it takes for fleet to give the host the label queries.
|
||||
|
||||
##### osquery_enable_async_host_processing
|
||||
|
||||
**Experimental feature**. Enable asynchronous processing of hosts query results. Currently, only supported for label query execution and policy membership results. This may improve performance and CPU usage of the fleet instances and MySQL database servers for setups with a large number of hosts, while requiring more resources from Redis server(s).
|
||||
**Experimental feature**. Enable asynchronous processing of hosts query results. Currently, only supported for label query execution and policy membership results. This may improve performance and CPU usage of the Fleet instances and MySQL database servers for setups with a large number of hosts, while requiring more resources from Redis server(s).
|
||||
|
||||
Note that currently, if both the failing policies webhook *and* this `osquery.enable_async_host_processing` option are set, some failing policies webhooks could be missing (some transitions from succeeding to failing or vice-versa could happen without triggering a webhook request).
|
||||
|
||||
@ -993,7 +1082,7 @@ Note that currently, if both the failing policies webhook *and* this `osquery.en
|
||||
|
||||
##### osquery_async_host_collect_interval
|
||||
|
||||
Applies only when `osquery_enable_async_host_processing` is enabled. Sets the interval at which the host data will be collected into the database. Each fleet instance will attempt to do the collection at this interval (with some optional jitter added, see `osquery_async_host_collect_max_jitter_percent`), with only one succeeding to get the exclusive lock.
|
||||
Applies only when `osquery_enable_async_host_processing` is enabled. Sets the interval at which the host data will be collected into the database. Each Fleet instance will attempt to do the collection at this interval (with some optional jitter added, see `osquery_async_host_collect_max_jitter_percent`), with only one succeeding to get the exclusive lock.
|
||||
|
||||
- Default value: 30s
|
||||
- Environment variable: `FLEET_OSQUERY_ASYNC_HOST_COLLECT_INTERVAL`
|
||||
@ -1019,7 +1108,7 @@ Applies only when `osquery_enable_async_host_processing` is enabled. A number in
|
||||
|
||||
##### osquery_async_host_collect_lock_timeout
|
||||
|
||||
Applies only when `osquery_enable_async_host_processing` is enabled. Timeout of the lock acquired by a fleet instance to collect host data into the database. If the collection runs for too long or the instance crashes unexpectedly, the lock will be automatically released after this duration and another fleet instance can proceed with the next collection.
|
||||
Applies only when `osquery_enable_async_host_processing` is enabled. Timeout of the lock acquired by a Fleet instance to collect host data into the database. If the collection runs for too long or the instance crashes unexpectedly, the lock will be automatically released after this duration and another Fleet instance can proceed with the next collection.
|
||||
|
||||
- Default value: 1m
|
||||
- Environment variable: `FLEET_OSQUERY_ASYNC_HOST_COLLECT_LOCK_TIMEOUT`
|
||||
@ -1108,6 +1197,20 @@ Applies only when `osquery_enable_async_host_processing` is enabled. Order of ma
|
||||
async_host_redis_scan_keys_count: 100
|
||||
```
|
||||
|
||||
##### Example YAML
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: config
|
||||
spec:
|
||||
osquery:
|
||||
host_identifier: uuid
|
||||
policy_update_interval: 30m
|
||||
duration: 4h
|
||||
status_log_plugin: firehose
|
||||
result_log_plugin: firehose
|
||||
```
|
||||
|
||||
#### Logging (Fleet server logging)
|
||||
|
||||
##### logging_debug
|
||||
@ -1164,6 +1267,17 @@ and a negative value to disable storage of errors in Redis.
|
||||
error_retention_period: 1h
|
||||
```
|
||||
|
||||
##### Example YAML
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: config
|
||||
spec:
|
||||
logging:
|
||||
disable_banner: true
|
||||
policy_update_interval: 30m
|
||||
error_retention_period: 1h
|
||||
```
|
||||
#### Filesystem
|
||||
|
||||
##### filesystem_status_log_file
|
||||
@ -1227,6 +1341,21 @@ This flag will cause the rotated logs to be compressed with gzip.
|
||||
enable_log_compression: true
|
||||
```
|
||||
|
||||
##### Example YAML
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: config
|
||||
spec:
|
||||
osquery:
|
||||
osquery_status_log_plugin: filesystem
|
||||
osquery_result_log_plugin: filesystem
|
||||
filesystem:
|
||||
status_log_file: /var/log/osquery/status.log
|
||||
result_log_file: /var/log/osquery/result.log
|
||||
enable_log_rotation: true
|
||||
```
|
||||
|
||||
#### Firehose
|
||||
|
||||
##### firehose_region
|
||||
@ -1334,6 +1463,24 @@ the stream listed:
|
||||
- `firehose:DescribeDeliveryStream`
|
||||
- `firehose:PutRecordBatch`
|
||||
|
||||
##### Example YAML
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: config
|
||||
spec:
|
||||
osquery:
|
||||
osquery_status_log_plugin: firehose
|
||||
osquery_result_log_plugin: firehose
|
||||
firehose:
|
||||
region: ca-central-1
|
||||
access_key_id: AKIAIOSFODNN7EXAMPLE
|
||||
secret_access_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
|
||||
sts_assume_role_arn: arn:aws:iam::1234567890:role/firehose-role
|
||||
status_stream: osquery_status
|
||||
result_stream: osquery_result
|
||||
```
|
||||
|
||||
#### Kinesis
|
||||
|
||||
##### kinesis_region
|
||||
@ -1446,6 +1593,26 @@ the stream listed:
|
||||
- `kinesis:DescribeStream`
|
||||
- `kinesis:PutRecords`
|
||||
|
||||
##### Example YAML
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: config
|
||||
spec:
|
||||
osquery:
|
||||
osquery_status_log_plugin: kinesis
|
||||
osquery_result_log_plugin: kinesis
|
||||
kinesis:
|
||||
region: ca-central-1
|
||||
result_log_file: /var/log/osquery/result.log
|
||||
access_key_id: AKIAIOSFODNN7EXAMPLE
|
||||
secret_access_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
|
||||
sts_assume_role_arn: arn:aws:iam::1234567890:role/firehose-role
|
||||
status_stream: osquery_status
|
||||
result_stream: osquery_result
|
||||
```
|
||||
|
||||
|
||||
#### Lambda
|
||||
|
||||
##### lambda_region
|
||||
@ -1556,6 +1723,24 @@ the function listed:
|
||||
|
||||
- `lambda:InvokeFunction`
|
||||
|
||||
##### Example YAML
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: config
|
||||
spec:
|
||||
osquery:
|
||||
osquery_status_log_plugin: lamda
|
||||
osquery_result_log_plugin: lamda
|
||||
lamda:
|
||||
region: ca-central-1
|
||||
access_key_id: AKIAIOSFODNN7EXAMPLE
|
||||
secret_access_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
|
||||
sts_assume_role_arn: arn:aws:iam::1234567890:role/firehose-role
|
||||
status_function: statusFunction
|
||||
result_function: resultFunction
|
||||
```
|
||||
|
||||
#### PubSub
|
||||
|
||||
##### pubsub_project
|
||||
@ -1626,9 +1811,27 @@ This feature is useful when combined with [subscription filters](https://cloud.g
|
||||
|
||||
```
|
||||
pubsub:
|
||||
status_topic: osquery_status
|
||||
add_attributes: true
|
||||
```
|
||||
|
||||
##### Example YAML
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: config
|
||||
spec:
|
||||
osquery:
|
||||
osquery_status_log_plugin: pubsub
|
||||
osquery_result_log_plugin: pubsub
|
||||
pubsub:
|
||||
project: my-gcp-project
|
||||
result_topic: osquery_result
|
||||
status_topic: osquery_status
|
||||
sts_assume_role_arn: arn:aws:iam::1234567890:role/firehose-role
|
||||
status_function: statusFunction
|
||||
result_function: resultFunction
|
||||
```
|
||||
|
||||
#### Kafka REST Proxy logging
|
||||
|
||||
##### kafkarest_proxyhost
|
||||
@ -1707,7 +1910,20 @@ can be found [here](https://docs.confluent.io/platform/current/kafka-rest/api.ht
|
||||
content_type_value: application/vnd.kafka.json.v2+json
|
||||
```
|
||||
|
||||
##### Example YAML
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: config
|
||||
spec:
|
||||
osquery:
|
||||
osquery_status_log_plugin: kafkarest
|
||||
osquery_result_log_plugin: kafkarest
|
||||
kafkarest:
|
||||
proxyhost: "https://localhost:8443"
|
||||
result_topic: osquery_result
|
||||
status_topic: osquery_status
|
||||
```
|
||||
#### S3 file carving backend
|
||||
|
||||
##### s3_bucket
|
||||
@ -1842,6 +2058,21 @@ Minio users must set this to any nonempty value (eg. `minio`), as Minio does not
|
||||
region: us-east-1
|
||||
```
|
||||
|
||||
##### Example YAML
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: config
|
||||
spec:
|
||||
s3:
|
||||
bucket: some-carve-bucket
|
||||
prefix: carves-go-here/
|
||||
access_key_id: AKIAIOSFODNN7EXAMPLE
|
||||
secret_access_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
|
||||
sts_assume_role_arn: arn:aws:iam::1234567890:role/some-s3-role
|
||||
region: us-east-1
|
||||
```
|
||||
|
||||
#### Upgrades
|
||||
|
||||
##### allow_missing_migrations
|
||||
@ -1853,15 +2084,18 @@ If set then `fleet serve` will run even if there are database migrations missing
|
||||
- Config file format:
|
||||
|
||||
```
|
||||
upgrades:
|
||||
allow_missing_migrations: true
|
||||
apiVersion: v1
|
||||
kind: config
|
||||
spec:
|
||||
upgrades:
|
||||
allow_missing_migrations: true
|
||||
```
|
||||
|
||||
#### Vulnerabilities
|
||||
|
||||
##### databases_path
|
||||
|
||||
The path specified needs to exist and fleet needs to be able to read and write to and from it. This is the only mandatory configuration needed for vulnerability processing to work.
|
||||
The path specified needs to exist and Fleet needs to be able to read and write to and from it. This is the only mandatory configuration needed for vulnerability processing to work.
|
||||
|
||||
When `current_instance_checks` is set to `auto` (the default), Fleet instances will try to create the `databases_path` if it doesn't exist.
|
||||
|
||||
@ -1889,7 +2123,7 @@ How often vulnerabilities are checked. This is also the interval at which the co
|
||||
|
||||
##### cpe_database_url
|
||||
|
||||
URL to fetch the CPE dictionary database from. Some users want to control where fleet gets its database from. When Fleet sees this value defined, it downloads the file directly. It expects a file in the same format as can be found in https://github.com/fleetdm/nvd/releases. If this value is not defined, Fleet checks for the latest release in Github and only downloads it if needed.
|
||||
URL to fetch the CPE dictionary database from. Some users want to control where Fleet gets its database from. When Fleet sees this value defined, it downloads the file directly. It expects a file in the same format as can be found in https://github.com/fleetdm/nvd/releases. If this value is not defined, Fleet checks for the latest release in Github and only downloads it if needed.
|
||||
|
||||
- Default value: `""`
|
||||
- Environment variable: `FLEET_VULNERABILITIES_CPE_DATABASE_URL`
|
||||
@ -1943,7 +2177,19 @@ To download the data streams, you can use `fleetctl vulnerability-data-stream --
|
||||
disable_data_sync: true
|
||||
```
|
||||
|
||||
### GeoIP
|
||||
##### Example YAML
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: config
|
||||
spec:
|
||||
vulnerabilities:
|
||||
databases_path: /some/path
|
||||
current_instance_checks: yes
|
||||
disable_data_sync: true
|
||||
|
||||
```
|
||||
#### GeoIP
|
||||
|
||||
##### database_path
|
||||
|
||||
@ -1957,8 +2203,11 @@ on the Fleet web server.
|
||||
- Config file format:
|
||||
|
||||
```yaml
|
||||
geoip:
|
||||
database_path: /some/path
|
||||
apiVersion: v1
|
||||
kind: config
|
||||
spec:
|
||||
geoip:
|
||||
database_path: /some/path
|
||||
```
|
||||
|
||||
|
||||
@ -2186,4 +2435,4 @@ If set then `fleet serve` will capture errors and panics and push them to Sentry
|
||||
dsn: "https://somedsnprovidedby.sentry.com/"
|
||||
```
|
||||
|
||||
<meta name="pageOrderInSection" value="300">
|
||||
<meta name="pageOrderInSection" value="300">
|
||||
|
@ -18,6 +18,13 @@
|
||||
- [Why my host is not updating a policy's response.](#why-my-host-is-not-updating-a-policys-response)
|
||||
- [What should I do if my computer is showing up as an offline host?](#what-should-i-do-if-my-computer-is-showing-up-as-an-offline-host)
|
||||
- [How does Fleet deal with IP duplication?](#how-does-fleet-deal-with-ip-duplication)
|
||||
- [Can Orbit run alongside osquery?](#can-orbit-run-alongside-osquery)
|
||||
- [Can I disable auto updates for Orbit?](#can-i-disable-auto-updates-for-orbit)
|
||||
- [Can I bundle osquery extensions into Orbit?](#can-i-bundle-osquery-extensions-into-orbit)
|
||||
- [How does Fleet work with osquery extensions?](#how-does-fleet-work-with-osquery-extensions)
|
||||
- [Why am I seeing "unknown certificate error" when adding hosts to my dev server?](#why-am-i-seeing-"unknown-certificate-error"-when-adding-hosts-to-my-dev-server)
|
||||
- [Can I hide known vulnerabilities that I feel are insignificant?](#can-i-hide-known-vulnerabilities-that-i-feel-are-insignificant)
|
||||
- [Can I create reports based on historical data in Fleet?](#can-i-create-reports-based-on-historical-data-in-fleet)
|
||||
|
||||
## What do I need to do to switch from Kolide Fleet to FleetDM Fleet?
|
||||
|
||||
@ -27,7 +34,7 @@ Minor version upgrades in Kolide Fleet often included database migrations and th
|
||||
|
||||
To migrate from `kolide/fleet` to the new Fleet, please follow the steps outlined in the [Upgrading Fleet section](../Deploying/Upgrading-Fleet.md) of the documentation.
|
||||
|
||||
## Has anyone stress tested Fleet? How many clients can the Fleet server handle?
|
||||
## Has anyone stress tested Fleet? How many hosts can the Fleet server handle?
|
||||
|
||||
Fleet has been stress tested to 150,000 online hosts and 400,000 total enrolled hosts. Production deployments exist with over 100,000 hosts and numerous production deployments manage tens of thousands of hosts.
|
||||
|
||||
@ -161,7 +168,7 @@ If your device is showing up as an offline host in the Fleet instance, and you'r
|
||||
|
||||
## Fleet preview fails with Invalid interpolation. What should I do?
|
||||
|
||||
If you tried running fleet preview and you get the following error:
|
||||
If you tried running `fleetctl preview` and you get the following error:
|
||||
|
||||
```
|
||||
fleetctl preview
|
||||
@ -182,10 +189,41 @@ Fleet relies on UUIDs so any overlap with host IP addresses should not cause a p
|
||||
|
||||
Yes, Orbit can be run alongside osquery. The osquery instance that Orbit runs uses its own database directory that is stored within the Orbit directory.
|
||||
|
||||
## Can I disable auto-updates for Orbit?
|
||||
|
||||
Yes, auto-updates can be disabled by passing `--disable-updates` as a flag when running `fleetctl package` to generate your installer (easy) or by deploying a modified systemd file to your hosts (more complicated). We'd recommend the flag:
|
||||
|
||||
```
|
||||
fleetctl package --fleetctl package --type=deb --fleet-url=https://localhost:8080 --enroll-secret=superRandomSecret --disable-updates
|
||||
```
|
||||
## Can I bundle osquery extensions into Orbit?
|
||||
|
||||
This isn't supported yet, but we're working on it!
|
||||
|
||||
## What happens to osquery logs if my Fleet server or my logging destination is offline?
|
||||
|
||||
If Fleet can't send logs to the destination, it will return an error to osquery. This causes osquery to retry sending the logs. The logs will then be stored in osquery's internal buffer until they are sent successfully, or they get expired if the `buffered_log_max`(defaults to 1,000,000 logs) is exceeded. Check out the [Remote logging buffering section](https://osquery.readthedocs.io/en/latest/deployment/remote/#remote-logging-buffering) on the osquery docs for more on this behavior.
|
||||
|
||||
## How does Fleet work with osquery extensions?
|
||||
|
||||
Any extension table available in a host enrolled to Fleet can be queried by Fleet. Note that the "compatible with" message may show an error because it won't know your extension table, but the query will still work, and Fleet will gracefully ignore errors from any incompatible hosts.
|
||||
|
||||
## Why do I see "Unknown Certificate Error" when adding hosts to my dev server?
|
||||
|
||||
If you are using a self-signed certificate on `localhost`, add the `--insecure` flag when building your installation packages:
|
||||
|
||||
```
|
||||
fleetctl package --fleetctl package --type=deb --fleet-url=https://localhost:8080 --enroll-secret=superRandomSecret --insecure
|
||||
```
|
||||
|
||||
## Can I hide known vulnerabilities that I feel are insignificant?
|
||||
|
||||
This isn't currently supported, but we're working on it! You can track that issue [here](https://github.com/fleetdm/fleet/issues/3152).
|
||||
|
||||
## Can I create reports based on historical data in Fleet?
|
||||
|
||||
Currently, Fleet only stores the current state of your hosts (when they last communicated with Fleet). The best way at the moment to maintain historical data would be to use the [REST API](./REST-API.md) or the [`fleetctl` CLI](./fleetctl-CLI.md) to retrieve it manually. Then save the data you need to your schedule.
|
||||
|
||||
## When do I need fleetctl vs the REST API vs the Fleet UI?
|
||||
|
||||
[fleetctl](https://fleetdm.com/docs/using-fleet/fleetctl-cli) is great for users that like to do things in a terminal (like iTerm on a Mac). Lots of tech folks are real power users of the terminal. It is also helpful for automating things like deployments.
|
||||
|
@ -1,6 +1,9 @@
|
||||
# fleetctl CLI
|
||||
|
||||
- [Introduction](#introduction)
|
||||
- [Using fleetctl](#using-fleetctl)
|
||||
- [Available commands](#available-commands)
|
||||
- [Get more info about a command](#get-more-info-about-a-command)
|
||||
- [Setting Up Fleet](#setting-up-fleet)
|
||||
- [Running Fleet](#running-fleet)
|
||||
- [`fleetctl config`](#fleetctl-config)
|
||||
@ -21,9 +24,67 @@ Fleetctl (pronounced "Fleet control") is a CLI tool for managing Fleet from the
|
||||
|
||||
Fleetctl also provides a quick way to work with all the data exposed by Fleet without having to use the Fleet UI or work directly with the Fleet API.
|
||||
|
||||
## Using fleetctl
|
||||
|
||||
You can use `fleetctl` to accomplish many tasks you would typically need to do through the UI(User Interface). You can even set up or apply configuration files to the Fleet server.
|
||||
|
||||
### Available commands
|
||||
|
||||
Much of the functionality available in the Fleet UI is also available in `fleetctl`. You can run queries, add and remove users, generate install packages to add new hosts, get information about existing hosts, and more! The following commands are available for use with `fleetctl`:
|
||||
|
||||
| Command | Description |
|
||||
|:---------------------------|:-------------------------------------------------------------------|
|
||||
| apply | Apply files to declaratively manage osquery configurations |
|
||||
| delete | Specify files to declaratively batch delete osquery configurations |
|
||||
| setup | Set up a Fleet instance |
|
||||
| login | Login to Fleet |
|
||||
| logout | Log out of Fleet |
|
||||
| query | Run a live query |
|
||||
| get | Get/list resources |
|
||||
| config | Modify Fleet server connection settings |
|
||||
| convert | Convert osquery packs into decomposed Fleet configs |
|
||||
| goquery | Start the goquery interface |
|
||||
| user | Manage Fleet users |
|
||||
| debug | Tools for debugging Fleet |
|
||||
| preview | Start a preview deployment of the Fleet server |
|
||||
| updates | Manage client updates |
|
||||
| hosts | Manage Fleet hosts |
|
||||
| vulnerability-data-stream | Download the vulnerability data stream |
|
||||
| package | Create an Orbit installer package |
|
||||
| help, h | Shows a list of commands or help for one command |
|
||||
|
||||
### Get more info about a command
|
||||
|
||||
Each command available to `fleetctl` has a help menu with additional information. To pull up the help menu, run `fleetctl <command> --help`, replacing `<command>` with the command you're looking up:
|
||||
|
||||
```
|
||||
> fleetctl setup --help
|
||||
```
|
||||
|
||||
You will see more info about the command, including the usage and information about any additional commands and options (or 'flags') that can be passed with it:
|
||||
|
||||
```
|
||||
NAME:
|
||||
fleetctl setup - Set up a Fleet instance
|
||||
|
||||
USAGE:
|
||||
fleetctl setup [options]
|
||||
|
||||
OPTIONS:
|
||||
--email value Email of the admin user to create (required) [$EMAIL]
|
||||
--name value Name or nickname of the admin user to create (required) [$NAME]
|
||||
--password value Password for the admin user (recommended to use interactive entry) [$PASSWORD]
|
||||
--org-name value Name of the organization (required) [$ORG_NAME]
|
||||
--config value Path to the fleetctl config file (default: "/Users/ksatter/.fleet/config") [$CONFIG]
|
||||
--context value Name of fleetctl config context to use (default: "default") [$CONTEXT]
|
||||
--debug Enable debug http request logging (default: false) [$DEBUG]
|
||||
--help, -h show help (default: false)
|
||||
|
||||
```
|
||||
|
||||
## Setting up Fleet
|
||||
|
||||
This section walks through setting up and configuring Fleet via the CLI. If you already have a running fleet instance, skip ahead to [Logging in to an existing Fleet instance](#logging-in-to-an-existing-fleet-instance) to configure the `fleetctl` CLI.
|
||||
This section walks through setting up and configuring Fleet via the CLI. If you already have a running Fleet instance, skip ahead to [Logging in to an existing Fleet instance](#logging-in-to-an-existing-fleet-instance) to configure the `fleetctl` CLI.
|
||||
|
||||
This guide illustrates:
|
||||
|
||||
|
1
fleet-errors-2022-03-30T18:19:49-05:00
Normal file
1
fleet-errors-2022-03-30T18:19:49-05:00
Normal file
@ -0,0 +1 @@
|
||||
[]
|
1
fleet-errors-2022-03-30T18:20:14-05:00
Normal file
1
fleet-errors-2022-03-30T18:20:14-05:00
Normal file
@ -0,0 +1 @@
|
||||
[]
|
1
fleet-errors-2022-03-30T18:22:24-05:00
Normal file
1
fleet-errors-2022-03-30T18:22:24-05:00
Normal file
@ -0,0 +1 @@
|
||||
[]
|
BIN
fleet-trace-2022-03-30T18:21:22-05:00
Normal file
BIN
fleet-trace-2022-03-30T18:21:22-05:00
Normal file
Binary file not shown.
Loading…
Reference in New Issue
Block a user