https://github.com/osquery/osquery logo
Powered by
#general
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:23 PM
    even after restart.
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:24 PM
    so apparently the records were put in the rockdb?
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:24 PM
    but for some reason not output to the results file
  • s

    Stefano Bonicatti

    07/20/2022, 1:25 PM
    I see, so part of the problem is that events expiration, querying evented tables is all a bit complex. I would need to double check but what 
    events_optimize
    is doing, is to prevent events that have already been queried to show again at a subsequent query from the same scheduled query. The problem though is that when you query/join two separate evented table, the events can appear at different times. Like the process events can appear before the query actually runs but the socket event appears after
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:26 PM
    I also notice two things : the "time" field is not that of when the command was issued (curl) but rather when osqueryd processed it (14:22, 4 minutes ago, but the commands were run much earlier).
  • s

    Stefano Bonicatti

    07/20/2022, 1:26 PM
    this means that the query runs, consumes the process events, the query doesn’t return results because it doesn’t match your constraints, and then at the next run there’s no process event to match your socket event
  • s

    Stefano Bonicatti

    07/20/2022, 1:27 PM
    I would say that that kind of query either you use the 
    processes
    table to match against (but then the process might not be running anymore), or you create 2 separate queries, where each feeds results to a backend, and the query is done in the backend
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:27 PM
    because it's in one table and not in the other?
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:28 PM
    (process + sockets)
  • s

    Stefano Bonicatti

    07/20/2022, 1:29 PM
    Yeah. Although admittedly you should be able to see a result sometime. I mean what I’m saying should only happen when the two events (process and socket) come one before the query has run and one after. This shouldn’t be always true
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:32 PM
    I see. So, disabling this means the events don't get immediately removed?
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:33 PM
    I mean disabling the events_optimize flag
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:34 PM
    Also, local port is always 0, which is strange.
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:34 PM
    for a TCP connection.
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:35 PM
    This is after curl facebook.com
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:35 PM
    Copy code
    {
  "name": "net.connexions",
  "hostIdentifier": "ychaouche-PC",
  "calendarTime": "Wed Jul 20 13:33:53 2022 UTC",
  "unixTime": 1658324033,
  "epoch": 0,
  "counter": 1,
  "numerics": false,
  "columns": {
    "action": "connect",
    "cmdline": "curl <http://facebook.com|facebook.com>",
    "epoch": "1658324030",
    "local_port": "0",
    "remote_address": "157.240.196.35",
    "remote_port": "80",
    "status": "in_progress",
    "time": "2022-07-20 13:33:50"
  },
  "action": "added"
}
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:36 PM
    And sorry about the time column I was wrong, I was looking at the wrong "time" field. The time field is good.
  • s

    Stefano Bonicatti

    07/20/2022, 1:36 PM
    That highly depends on audit but I think the problem is that if the syscall (connect in this case) doesn’t have the local port as a parameter/argument, then it won’t display
  • s

    Stefano Bonicatti

    07/20/2022, 1:37 PM
    It’s not an information that’s immediately available to the kernel where it’s generating the event afaik
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:37 PM
    well it takes a socket fd
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:37 PM
    int connect(int sockfd, const struct sockaddr *addr,socklen_t addrlen);
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:38 PM
    sockets should be bound to a port, but maybe not at connect time, not sure.
  • s

    Stefano Bonicatti

    07/20/2022, 1:39 PM
    no sure, but we are not doing any additional work when displaying audit events; we are not evaluating the socket fd to then get additional information about the scocket fd, which btw could be out of date, because it won’t be inline with the event
  • s

    Stefano Bonicatti

    07/20/2022, 1:39 PM
    so what’s available in the audit event is what we display
  • s

    Stefano Bonicatti

    07/20/2022, 1:40 PM
    I think the local port is only displayed with a 
    bind
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:42 PM
    yes, apparently connect is responsible of creating the port because it has a EAGAIN error which description reads like this : 
    EAGAIN No  more free local ports [...].
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:44 PM
    Thanks for the brilliant troubleshooting @Stefano Bonicatti, I can at last start playing with osqueryd and see what I can do with it.
  • r

    Rafa

    07/20/2022, 2:25 PM
    Hi people! I do not know if this is the appropriate forum (let me know if not) but there is any plan to have OSQUERY executing commands in the machines monitored by it?
  • h

    Hugh (Zercurity)

    07/20/2022, 2:27 PM
    @Rafa no, there are a few projects that build extensions for allowing update sql commands to change system settings.
  • h

    Hugh (Zercurity)

    07/20/2022, 2:27 PM
    As far as I am aware osquery will remain query only
1...585960...79Latest