extensions
  • Ryan Small

    Ryan Small

    09/03/2021, 7:27 PM
    Hi, does any one have any documentation on what the numeric monitoring is generating?
  • j

    Jean M

    09/13/2021, 9:11 AM
    Hello, (about the same extension) I’m having problems running the extension in Windows I was wondering if the problem had happened before with someone else… if I load the extension manually (1st the osquery --nodisable_extensions then ./extension --socket …) it works fine. However, if I use osquery --extension or the extensions.load file, an error message shows when trying to create extension process, osqueryd seems to be booting… but then it quits in a strange way. I’m using --allow_nosafe option but I don’t think it is related. Any idea?
    PS C:\Program Files\osquery> .\osqueryd\osqueryd.exe --flagfile osquery.flags --verbose
    I0913 01:37:43.778841  4896 init.cpp:342] osquery initialized [version=4.7.0]
    I0913 01:37:43.825711  4896 system.cpp:342] Found stale process for osqueryd (10920)
    I0913 01:37:43.825711  4896 system.cpp:374] Writing osqueryd pid (5116) to \Program Files\osquery\osqueryd.pidfile
    I0913 01:37:43.825711  4896 extensions.cpp:438] Found autoloadable extension: C:\Program Files\osquery\extensions\myosquery.ext
    I0913 01:37:43.825711  4896 dispatcher.cpp:78] Adding new service: WatcherRunner (000001AB7BFC9F30) to thread: 13760 (000001AB7DB4FCC0) in process 5116
    I0913 01:37:43.841331 13760 watcher.cpp:613] osqueryd watcher (5116) executing worker (10352)
    E0913 01:37:43.856961 13760 watcher.cpp:653] Cannot create extension process: C:\Program Files\osquery\extensions\myosquery.ext
    I0913 01:37:43.856961  4896 dispatcher.cpp:149] Thread: 4896 requesting a stop
    ...
    I0913 01:37:46.891346 13672 watcher.cpp:667] osqueryd worker (10352) detected killed watcher (5116)
    I0913 01:37:46.891346 12320 dispatcher.cpp:149] Thread: 12320 requesting a stop
    I0913 01:37:46.891346 12320 dispatcher.cpp:156] Service: 0000021774EF2CB0 has been interrupted
    ...
    Full log at: https://pastebin.com/Ygm7CGX1 (112233). I’ve used
    procmon
    and I couldn’t find any attempt to launch the extension process. While doing that, I noticed a werfault.exe was being executed. Looking at Windows Events it seems osquery crashed:
    Faulting application name: osqueryd.exe, version: 4.7.0.0, time stamp: 0x6050e93f
    Faulting module name: osqueryd.exe, version: 4.7.0.0, time stamp: 0x6050e93f
    Exception code: 0xc0000005
    Fault offset: 0x00000000009da964
    Faulting process id: 0x37c0
    Faulting application start time: 0x01d7a87be147ff10
    Faulting application path: C:\Program Files\osquery\osqueryd\osqueryd.exe
    Faulting module path: C:\Program Files\osquery\osqueryd\osqueryd.exe
    Report Id: e7704eb3-e66d-439b-aa1f-331f195cb88c
    Faulting package full name: 
    Faulting package-relative application ID:
  • i

    ihor

    11/05/2021, 9:28 AM
    Hello, has anybody faced an issue with extensions using osquery 5.0.1 for windows from https://osquery.io/downloads? For some reason our extension has stopped working with that version (we just see the following in the logs:
    I1104 15:49:32.779342 11716 extensions.cpp:348] Extension UUID 18380 has gone away
    ). When we compile 5.0.1 by ourselves then there are no any issues.
  • j

    Jason NG

    11/24/2021, 8:48 AM
    Hi, I am trying to autoload an extension in windows. But it doesnt get registered for some reason. it also does not throw back any error and osquery can start as per normal. Is this a bug? I referenced it from https://github.com/osquery/osquery/issues/7324
  • m

    Matt Ackard

    11/30/2021, 10:04 PM
    Hi all. I'm trying to run the osqueryi profiler on some custom extension tables and am not having any luck. I can run osqueryi interactively and all works. Passing the query directly to osqueryi along with an
    extensions_require
    flag works too. Can't pass the query directly if the extensions require flag is not passed. Everything works fine in osqueryd as well. If I try adding
    profile_delay
    it seems like the extension can't connect to the socket. Has anyone run into this issue? I'll add some osqueryi outputs in thread
  • Mike Myers

    Mike Myers

    12/01/2021, 4:50 PM
    Hmm that's odd because
    Extension registered table plugin
    for several tables implies the extension was communicating over the Thrift channel ...and then suddenly
    An error occurred during extension manager startup
    . Is this extension one of the public ones that others can grab and try to reproduce this problem?
  • d

    Dhruv Rathod

    01/25/2022, 9:47 AM
    Hi everyone
    instance = osquery.ExtensionClient('\\\\.\pipe\shell.em')
    instance.open()
    client = instance.extension_client()
    print(client.query('select * from time'))
    In this code, it's possible to query osquery via the thrift socket without creating any new extension. I want to ask if it is also possible to set the config and get the logs for the running osquery instance without creating a new extension, and just read/write via the extension_client?
  • d

    Dhruv Rathod

    02/08/2022, 7:35 AM
    FOR WINDOWS : Hi everyone: I am trying to run this extension (file attached below:
    python_config.ext
    ). I have placed this file in Extensions folder in the osquery root. I tried
    .\osqueryd.exe --flagfile .\osquery.flags --verbose
    but I am getting an error saying
    E0208 12:58:29.730865  3680 watcher.cpp:702] Cannot create extension process: C:\Program Files\osquery\Extensions\python-config.ext
    . I have set safe permissions according to this link: https://osquery.readthedocs.io/en/stable/deployment/extensions/#extensions-binary-permissions . Can anyone help me with this? cuz when I run this extension as
    python python-config.ext --socket=\\.\pipe\shell.em
    , it works perfectly and the extension is loaded
  • mikermcneil

    mikermcneil

    03/17/2022, 1:56 AM
    Do osquery extensions enable an ecosystem/platform for vendors like this who want to hook into an existing agent without writing their own? If so, what docs, extension-loader error messages, extension linting/tools for extension devs, and tutorials are we missing to make it dead simple? https://techcrunch.com/2022/03/16/clockwork-raises-21m-to-keep-server-clocks-in-sync/
  • CptOfEvilMinions

    CptOfEvilMinions

    04/06/2022, 5:13 PM
    Using osquery-go can I access the flags set in
    osquery.flags
    in my extension?
  • hubert dulay

    hubert dulay

    06/10/2022, 12:10 PM
    Hi. Running osqueryi on macos using a python extension to send to apache pulsar. Getting this error below. Can anyone help? Thanks
    W0609 16:06:53.907390 13324288 watcher.cpp:624] Extension respawning too quickly: ./simple.ext
    I0609 16:06:53.908399 13324288 watcher.cpp:658] Created and monitoring extension child (95012): ./simple.ext
    I tried both
    osqueryi version 4.9.0
    and
    5.2.3
  • hubert dulay

    hubert dulay

    06/10/2022, 12:43 PM
    Also tried ubuntu with the same error. Thanks
  • p

    Praveen Kumar

    09/09/2022, 12:40 PM
    I am facing the issue: Extension socket not available: /var/osquery/osquery.em when try to execute below cpp program!.. int main(int argc, char* argv[]) { osquery::Initializer runner(argc, argv, ToolType::EXTENSION); auto status = startExtension("example", "0.0.1"); if (!status.ok()) { LOG(ERROR) << status.getMessage(); runner.requestShutdown(status.getCode()); }} requesting a help here
  • s

    seph

    09/09/2022, 1:57 PM
    Well, is osquery running?
  • s

    seph

    09/09/2022, 1:57 PM
    Is it configured to have a socket there?
  • s

    seph

    09/09/2022, 1:57 PM
    Do you have permission to read it?
  • p

    Praveen Kumar

    09/09/2022, 7:04 PM
    s, it is running in the xcode
  • p

    Praveen Kumar

    09/09/2022, 7:05 PM
    how to configure to have socket name there ?
  • p

    Praveen Kumar

    09/09/2022, 7:05 PM
    s, I have a permission to read it
  • s

    seph

    09/09/2022, 7:44 PM
    I don’t know much about xcode.
  • s

    seph

    09/09/2022, 7:45 PM
    What socket is osquery running with? You’d need to pass that to the extension
  • Daniel Bretón Suárez

    Daniel Bretón Suárez

    09/15/2022, 3:59 PM
    I want to thank the people from Trail Of Bits for publishing https://github.com/trailofbits/osquery-extensions. It has been very useful to understand how to build an extension!!!
  • Daniel Bretón Suárez

    Daniel Bretón Suárez

    10/06/2022, 7:14 AM
    I'm trying to build a coverage report for an extension using the
    gcovr
    tool (on which I have very little knowledge).
    .gcno
    and
    .gcda
    files are generated but test coverage is always 0% in all the sources. At the moment I'm blocked, all the guides I've read say it should work. Maybe someone can point me in the right direction? I think it is related to the way extensions are built because sources are in a different folder than binaries. However,
    gcovr
    has a
    --root
    option on which source files can be specified so it might not be the problem. This are the steps I'm performing on Ubuntu
    cd osquery
    ln -s /home/danielbreton/workspace/osquery-extension-hello/ external/extension_hello
    cd build
    cmake -DOSQUERY_TOOLCHAIN_SYSROOT=/usr/local/osquery-toolchain -DOSQUERY_BUILD_TESTS=ON -DENABLE_COVERAGE=true ..
    cmake --build . -j$(nproc) --target hello_my_friend_extension_test
    ./external/extension_hello/hello_my_friend_extension_test
    gcovr --xml-pretty --exclude-unreachable-branches --print-summary -o coverage.xml --root /home/danielbreton/workspace/osquery-extension-hello/
    And this is the complete
    CMakeLists.txt
    for the extension
    project("hello_my_friend_extension")
    
    addOsqueryExtension(
      "${PROJECT_NAME}"
      hello.cpp
      main.cpp
    )
    
    set(common_test_files
      hello.cpp
    )
    
    add_executable(
      "${PROJECT_NAME}_test"
      EXCLUDE_FROM_ALL
      ${common_test_files}
      test.cpp
    )
    
    if(ENABLE_COVERAGE)
      message("Enabling coverage")
      # set compiler flags
      set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -O0 -fprofile-arcs -ftest-coverage")
      set(CMAKE_CXX_FLAGS " ${CMAKE_CXX_FLAGS} -O0 -fprofile-arcs -ftest-coverage")
      # find required tools
      find_program(GCOVR gcovr REQUIRED)
    endif()
    
    target_link_libraries("${PROJECT_NAME}_test" PRIVATE
      thirdparty_googletest
      osquery_sdk_pluginsdk
      osquery_extensions_implthrift
    )
    
    if(ENABLE_COVERAGE)
      add_link_options("--coverage")
    endif()
    Project tree
    danielbreton@2022-EMEA-0022 ~/workspace/osquery-extension-hello (feature/UA-1101)$ tree
    .
    ├── CMakeLists.txt
    ├── hello.cpp
    ├── hello.h
    ├── main.cpp
    ├── README.md
    └── test.cpp
  • Daniel Bretón Suárez

    Daniel Bretón Suárez

    10/06/2022, 7:17 AM
    ⬆️ sorry for a message so long
  • Mike Myers

    Mike Myers

    10/06/2022, 7:20 PM
    this is a possible CMake question for @alessandrogario (see above)
  • Daniel Bretón Suárez

    Daniel Bretón Suárez

    11/08/2022, 1:27 PM
    Hi! I'm trying to build a
    config_parser
    in a C++ extension. I'm using
    REGISTER_EXTERNAL
    macro and I see the debug message at
    registry_factory.cpp
    I1108 12:56:08.491199 231789 registry_factory.cpp:107] Extension 499 registered config_parser plugin devo_params
    However, the update function is never called. If I add some debug messages to
    osquery/config/config.cpp
    and print the list of all config_parser modules it handles, I can't see it. However, if I add the same function at the extension code, it exists! Any ideas why this could be happening?
    void printAll()
    {
      auto plugins = osquery::RegistryFactory::get().plugins("config_parser");
      for (auto & p : plugins) {
        printf("registered parser %s\n", p.first.c_str());
      }
    }
  • r

    Rupert

    11/10/2022, 3:16 PM
    I'm new to osquery & looking for some troubleshooting advice I built & installed this extension https://github.com/aquasecurity/kube-query & it works fine when used from the repl:
    KUBECONFIG="${HOME}/.kube/config" osqueryi --extension "${HOME}/.local/bin/kube-query"
    osquery> -- this works ok
    osquery> select * from kubernetes_pods limit 1;
    when i pass in the query from the cli none of the
    kubernetes_
    tables show up & I can't query on them;
    # no kubernetes tables in this list
    KUBECONFIG="${HOME}/.kube/config" osqueryi --extension "${HOME}/.local/bin/kube-query" '.tables'
    
    # gives Error: no such table: kubernetes_pods
    KUBECONFIG="${HOME}/.kube/config" osqueryi --extension "${HOME}/.local/bin/kube-query" 'select * from kubernetes_pods limit 1'
    any advice appreciated!
  • Daniel Bretón Suárez

    Daniel Bretón Suárez

    12/01/2022, 11:48 AM
    I'm trying to send a post message to a server from an extension using
    http_client
    , somehow like this:
    osquery::http::Client client;
    client.setOptions(getOptions()); /* Local function to fill options */
    <http://client.post|client.post>(request, params); /* crashes on Windows */
    Works fine on Ubuntu, but it crashes on Windows. https://github.com/osquery/osquery/blob/a5bc1a33f2ad5eecb1a814d472c00a30c410d394/osquery/remote/http_client.cpp#L119 There's also a comment that says there is a leak, Is there any way to avoid this?