Fleet Client upgrades - How to

[trb143]

I have SO running at 2.3.2 and OSQuery running at 4.5.1.
I have a client showing version 4.4.0.

What is the correct way to update the client as I thought we had auto-updating?

[defensivedepth]

What do you mean that osquery is running at 4.5.1? I'm assuming that some of your osquery clients are at 4.4.0 and some at 4.5.1?

Yes, by default, each osquery client checks in every 60min to https://dl.kolide.co to see if there is an update available - if there is, it will download it and update itself. You can verify this by running the following query against your osquery endpoints:

SELECT * FROM kolide_launcher_autoupdate_config;

I just deployed a new osquery client on a Windows 10 device - it deployed as 4.4.0, but then upgraded itself to 4.5.1 within 15min of deploying. The informational card you see in Fleet doesnt get updated right away - if you run the following query, you can see what version is actually running on the endpoint:

SELECT * FROM osquery_info;

[OzzyKampha]

How will this work in a aircapped deployment? can it pull from the master node maybe?

[defensivedepth]

When the manager is updated, the packages will be updated on the manager. Then you can download those updated packages from the manager and deploy them to your airgapped endpoints.

[OzzyKampha]

Thank you