{"action":"created","issue":{"url":"https://api.github.com/repos/facebook/osquery/issues/1676","labels_url":"https://api.github.com/repos/facebook/osquery/issues/1676/labels{/name}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/1676/comments","events_url":"https://api.github.com/repos/facebook/osquery/issues/1676/events","html_url":"https://github.com/facebook/osquery/issues/1676","id":118424391,"number":1676,"title":"feature request: attempt re-enroll if node_invalid","user":{"login":"blackfist","id":752444,"avatar_url":"https://avatars.githubusercontent.com/u/752444?v=3","gravatar_id":"","url":"https://api.github.com/users/blackfist","html_url":"https://github.com/blackfist","followers_url":"https://api.github.com/users/blackfist/followers","following_url":"https://api.github.com/users/blackfist/following{/other_user}","gists_url":"https://api.github.com/users/blackfist/gists{/gist_id}","starred_url":"https://api.github.com/users/blackfist/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blackfist/subscriptions","organizations_url":"https://api.github.com/users/blackfist/orgs","repos_url":"https://api.github.com/users/blackfist/repos","events_url":"https://api.github.com/users/blackfist/events{/privacy}","received_events_url":"https://api.github.com/users/blackfist/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/facebook/osquery/labels/feature","name":"feature","color":"bfe5bf"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/facebook/osquery/milestones/10","html_url":"https://github.com/facebook/osquery/milestones/1.6.2","labels_url":"https://api.github.com/repos/facebook/osquery/milestones/10/labels","id":1428431,"number":10,"title":"1.6.2","description":"","creator":{"login":"theopolis","id":981645,"avatar_url":"https://avatars.githubusercontent.com/u/981645?v=3","gravatar_id":"","url":"https://api.github.com/users/theopolis","html_url":"https://github.com/theopolis","followers_url":"https://api.github.com/users/theopolis/followers","following_url":"https://api.github.com/users/theopolis/following{/other_user}","gists_url":"https://api.github.com/users/theopolis/gists{/gist_id}","starred_url":"https://api.github.com/users/theopolis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theopolis/subscriptions","organizations_url":"https://api.github.com/users/theopolis/orgs","repos_url":"https://api.github.com/users/theopolis/repos","events_url":"https://api.github.com/users/theopolis/events{/privacy}","received_events_url":"https://api.github.com/users/theopolis/received_events","type":"User","site_admin":false},"open_issues":8,"closed_issues":0,"state":"open","created_at":"2015-11-25T00:20:42Z","updated_at":"2015-12-02T23:55:04Z","due_on":"2015-12-08T08:00:00Z","closed_at":null},"comments":12,"created_at":"2015-11-23T16:57:37Z","updated_at":"2015-12-03T02:03:33Z","closed_at":null,"body":"If my understanding is correct, when an osquery endpoint receives a node_invalid message from an https server (perhaps running windmill) it will just go on with life and try again later. So if our database got nuked somehow then we would have thousands of servers that can't pull their config. There's also no easy migration path to go from one server to another.\r\n\r\nIt would be nice if there was a feature flag along the lines of --re-enroll-after-fails = n. If not set then the current behavior persists. But if set, then after receiving `node_invalid` n times the server will attempt to re-enroll. That way, migrating to a new server is as easy as a DNS change, and a puking database doesn't require me to have to log into thousands of machines and delete the rocksdb."},"comment":{"url":"https://api.github.com/repos/facebook/osquery/issues/comments/161493662","html_url":"https://github.com/facebook/osquery/issues/1676#issuecomment-161493662","issue_url":"https://api.github.com/repos/facebook/osquery/issues/1676","id":161493662,"user":{"login":"adrianmacneil","id":637671,"avatar_url":"https://avatars.githubusercontent.com/u/637671?v=3","gravatar_id":"","url":"https://api.github.com/users/adrianmacneil","html_url":"https://github.com/adrianmacneil","followers_url":"https://api.github.com/users/adrianmacneil/followers","following_url":"https://api.github.com/users/adrianmacneil/following{/other_user}","gists_url":"https://api.github.com/users/adrianmacneil/gists{/gist_id}","starred_url":"https://api.github.com/users/adrianmacneil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adrianmacneil/subscriptions","organizations_url":"https://api.github.com/users/adrianmacneil/orgs","repos_url":"https://api.github.com/users/adrianmacneil/repos","events_url":"https://api.github.com/users/adrianmacneil/events{/privacy}","received_events_url":"https://api.github.com/users/adrianmacneil/received_events","type":"User","site_admin":false},"created_at":"2015-12-03T02:03:33Z","updated_at":"2015-12-03T02:03:33Z","body":"Perhaps this is what you meant, but I think it's important to distinguish between an invalid response, and a `node_invalid` response. I suggest only reenrolling if an HTTP 200 response is received with the body `{\"node_invalid\": true}`. Otherwise, it's possible that a temporary server-side error would lead to a whole bunch of nodes reenrolling and potentially losing their current state (if the node_key was being used as a primary identifier)."}}