Expansion of host vitals

[noahtalerman]

UPDATE: Closed this issue this issue because 5 and 6 (from "Problem" section below) are now tracked in separate issues: #6434 and #9783 respectively.

Both haven't shipped.

Please bring them to feature fest if you think they should be considered for prioritization.

If you're looking for the ability to show custom query results on each host's Host details page, the issue is here: #14415

#14415 was shipped in Fleet 4.42.

(noahtalerman 2024-03-14).

---

UPDATE: 5 (#6434) and 6 (#6431) in the "Goals" section below will be addressed in Q4 2022. All other goals will be addressed in Q3 2022 (noahtalerman 2022-08-31).

Problem

I'm an engineer managing thousands of hosts and I'm overwhelmed with tracking my goals for each of these hosts.

This makes is hard to make progress on my goals because I don't know what hosts I need to take action on.

The following are my goals:

1. Know how many hosts, and which hosts, are running unsupported Windows versions: Know how many hosts, and which hosts, are running unsupported Windows versions #6428
2. Know how many hosts, and which hosts, have a low amount of remaining disk space: Know how many hosts, and which hosts, have a low disk space #7479
3. Know how many hosts, and which hosts, have Munki issues: Know how many hosts, and which hosts, have Munki issues #6430
4. Know how many hosts, and which hosts, are enrolled in a specific Mobile device management (MDM) solution: Know how many hosts, and which hosts, are enrolled in a specific Mobile device management (MDM) solution #6433
5. Know how many hosts, and which hosts, have MDM issues: Know when the MDM certificate is removed from the Keychain #6434
6. Know which Active Directory (AD) users use a host: Add Microsoft Account (Office 365 and Azure AD Account) information to the "Used by" field #9783
7. Know how many hosts, and which hosts, have not last checked into Fleet in the last 10 days: Know how many hosts, and which hosts, are missing #6435

[noahtalerman]

The majority of information required for this feature requires osquery extensions. Orbit can manage these extensions.

[noahtalerman]

Tip from a community member:

osquery query to determine the "Most active apps" that uses a constructed munki_app_usage table:

SELECT event,
       bundle_id,
       app_version,
       app_path,
       last_time,
       number_times
FROM munki_app_usage
WHERE event != "quit"
  AND app_path not like "/System%"
  AND CAST(number_times AS integer) > 5
  AND CAST(last_time AS INTEGER) >
    (SELECT CAST(strftime('%s', 'now', '-90 day') AS INT))
ORDER BY CAST(number_times AS INTEGER) DESC;

The following can be added to the config yaml configuration file to construct this table using Fleet:

apiVersion: v1
kind: config
spec:
  agent_options:
    config:
      options:
        ...
    overrides:
      platforms:
        darwin:
          auto_table_construction:
            munki_app_usage:
              columns:
                - event
                - bundle_id
                - app_version
                - app_path
                - last_time
                - number_times
              path: /Library/Managed Installs/application_usage.sqlite
              query:
                select event, bundle_id, app_version, app_path, last_time, number_times
                from application_usage

[zhumo]

Can we remove this from the roadmap board, and then put the child epics on the roadmap board when they're in the appropriate state? Otherwise, this is gonna sit here for a long time.

[noahtalerman]

Hey @Patagonia121, during feature fest, we discussed that we brought this request to feature fest because customer-ufa is looking for the ability to add custom data to the Host details page.

This was addressed by this separate user story: "See latest query results per-host": #14415 (shipped in Fleet 4.42)

Have we gotten any feedback from the customer on the "See latest query results per-host" feature yet?

[noahtalerman]

Closed this issue this issue because 5 and 6 (from "Problem" section below) are now tracked in separate issues: #6434 and #9783 respectively.

More information is in the issue description here: #397 (comment)

[fleet-release]

Hosts in the thousands,
Fleet eases your burdened mind,
Vitals clear, defined.