fleetdm
Query reports should reset after editing targeted hosts
Fleet version: 4.44
💥 Actual behavior
If a query has a report, and I narrow down the targeted hosts by changing the query's platforms or min osquery version, results from hosts that the query no longer targets remain in the report with stale results that never update.
(This was a gap in the original design — we didn't think to reset the report when platform or min version is modified.)
🧑💻 Steps to reproduce
- Create a query targeting all hosts & all platforms
- Let the query collect results
- Edit the query to only collect results from 1 platform. See results from hosts on other platforms grow stale.
🕯️ More info (optional)
N/A
🛠️ To fix
Show confirmation modal & clear the report when saving changes to a query's targeted platforms or min osquery version
@sharon-fdm @lucasmrod
I just ran into an issue, what if they save the query.platform as "darwin,linux" which is equivalent to "linux,darwin"? I'm assuming BE and FE should account for all equivalent combinations and not reset the query report (nor show a warning about a reset)?
I just ran into an issue, what if they save the
query.platformas"darwin,linux"which is equivalent to"linux,darwin"? I'm assuming BE and FE should account for all equivalent combinations and not reset the query report (nor show a warning about a reset)?
Correct. Backend should be smart and not clear the query report in such case.
@RachelElysia @lucasmrod Where do we stand with this? Should we create a bug ticket for this?
Should we create a bug ticket for this?
I don't think so, what Rachel comments here is related to fixing this bug/issue properly.
@lucasmrod I made a feature branch we can both merge into 17018-reset-query-report
Fix the query's scope, Clear stale data, fresh insight. Like dew at dawn's light.
