Yogesh Jadhav
08/05/2023, 6:30 AMAndrea
08/19/2023, 12:36 PMosquery::InternalRunnable
(as other places probably) is affected by clock adjustments (for sure on Windows, not sure on other platforms). Found this bug that basically say std::this_thread::sleep_until
and std::this_thread::sleep_for
implementation are based on a system_clock
rather than a steady_clock
. On top of it possibly other functions are affected such as:
std::condition_variable::wait_for
std::condition_variable::wait_until
std::condition_variable_any::wait_for
std::condition_variable_any::wait_until
std::future::wait_for
std::future::wait_until
std::recursive_timed_mutex::try_lock_for
std::recursive_timed_mutex::try_lock_until
std::shared_future::wait_for
std::shared_future::wait_until
std::shared_lock::try_lock_for
std::shared_lock::try_lock_until
std::shared_timed_mutex::try_lock_for
std::shared_timed_mutex::try_lock_until
std::shared_timed_mutex::try_lock_shared_for
std::shared_timed_mutex::try_lock_shared_until
std::timed_mutex::try_lock_for
std::timed_mutex::try_lock_until
std::unique_lock::try_lock_for
std::unique_lock::try_lock_until
shockedseph
Stefano Bonicatti
09/05/2023, 8:33 PM5.9.0.a
which is causing failures for the Windows builds on the latest commit (since the tag is there). Is that still necessary for tests or?JanRC
09/12/2023, 9:52 AMStefano Bonicatti
10/04/2023, 12:48 PMseph
master
. https://github.com/osquery/osquery/pull/8037 introduced an issue. I was hoping we’d have a fix up today, but I think not. Worst case, I’ll back that PR outStefano Bonicatti
10/06/2023, 7:07 PMseph
seph
wifi_survey
as well. CI wait….seph
seph
seph
seph
clong
10/09/2023, 6:18 PMseph
Stefano Bonicatti
10/10/2023, 6:18 PMclong
10/16/2023, 7:08 PMsharvil
10/20/2023, 3:03 PMbuild_windows (Release, 64, windows-2019)
workflowseph
seph
sharvil
10/24/2023, 6:21 PMseph
seph
pemberton:updates seph$ ./osqueryd/5.9.1/osqueryd -S 'SELECT * FROM magic WHERE path="/bin/ls"'
+---------+-----------------------------------------------------+---------------------------------------------------------------------------------------------------------------------------------+---------------------------+--------------------+
| path | magic_db_files | data | mime_type | mime_encoding |
+---------+-----------------------------------------------------+---------------------------------------------------------------------------------------------------------------------------------+---------------------------+--------------------+
| /bin/ls | /usr/share/file/magic.mgc:/usr/share/misc/magic.mgc | Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64e:Mach-O 64-bit executable arm64e] | application/x-mach-binary | (null)(null)binary |
+---------+-----------------------------------------------------+---------------------------------------------------------------------------------------------------------------------------------+---------------------------+--------------------+
pemberton:updates seph$ ./osqueryd/5.10.2/osqueryd -S 'SELECT * FROM magic WHERE path="/bin/ls"'
/usr/share/file/magic.mgc, 1: Warning: offset `?' invalid
Version=' invalidagic.mgc, 2: Warning: offset `
/usr/share/file/magic.mgc, 3: Warning: offset `' invalid
/usr/share/file/magic.mgc, 6: Warning: offset `Firmware v' invalid
/usr/share/file/magic.mgc, 12: Warning: offset `' invalid
Corel Corporation' invalid 13: Warning: offset `
I’m inclined to blame the libmagic upgrade in https://github.com/osquery/osquery/pull/8142Zack Olson
10/30/2023, 6:23 PMStefano Bonicatti
11/08/2023, 10:21 AMJerfe
11/13/2023, 2:59 PMArtem
11/14/2023, 7:25 PMprocess_open_sockets
and listening_ports
tables on Linux load balancers with open sockets highload?
We have a number of servers acting as external load balancers that can have over 200,000 active TCP/UDP sockets at any time.
And on these servers we cannot effectively use the tables described above, because such queries often exceed the watchdog memory limit, although we raised it to 400 megabytes. As result they got denylisted.
As I think, at the C++ code level, osquery first receives the full set of all sockets, and then applies the specified filters to this set.
Perhaps there are some opportunities for optimization here.JanRC
11/21/2023, 1:29 PMStefano Bonicatti
12/05/2023, 7:39 PM