https://github.com/osquery/osquery logo
Powered by
general
  • y

    Yassine CHAOUCHE

    07/20/2022, 12:59 PM
    oh...
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:01 PM
    apparently osqueryd and osqueryl will battle to set the owner for netlink
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:02 PM
    got a few 
    I0720 14:00:55.600761 25136 auditdnetlink.cpp:648] Failed to set the netlink owner
    until I quit osqueryi
  • s

    Stefano Bonicatti

    07/20/2022, 1:02 PM
    Yeah the netlink socket can only be accessed by a single process
  • s

    Stefano Bonicatti

    07/20/2022, 1:03 PM
    That’s why auditd must be stopped for osquery to work
  • s

    Stefano Bonicatti

    07/20/2022, 1:03 PM
    technically there’s the audisp “plugin” for audit which multiplexes the events, but osquery is not using that
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:03 PM
    ACK.
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:04 PM
    auditd isn't even installed, but i'll try to remember to not also run osqueryi in parallel
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:04 PM
    🙂
  • s

    Stefano Bonicatti

    07/20/2022, 1:04 PM
    I mean you can run osqueryi in parallel, just not to test audit events, and with that configuration enabled.
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:05 PM
    yes we're on the same line.
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:06 PM
    results file still empty 😞
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:06 PM
    Got a few 
    Malformed syscall event. The saddr field in the AUDIT_SOCKADDR record could not be parsed: "00000000000000000000000000000000"
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:06 PM
    osqueryi quit, osqueryd restarted after osqueri quit
  • s

    Stefano Bonicatti

    07/20/2022, 1:10 PM
    As far as I can tell it’s receiving events now, it just encountered an event that wasn’t sure how to parse correctly. There might be a bug, or the event (or even the actually API call) might’ve been malformed. That been said if now you try to create some socket events that match your query, they should be logged.
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:12 PM
    hmm, I've made a few (half a dozen) curl requests to google just to test, still nothing.
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:12 PM
    here's verbose output from the command line https://osquery.slack.com/files/T08V7PM9C/F03Q8TZ3AQ2
    osqueryd_--verbose
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:12 PM
    Not sure what's the best way to share logs
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:13 PM
    Yeah, not that great at all.
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:13 PM
    I think I'll share a gist.
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:14 PM
    This should be a little more readable : https://gist.githubusercontent.com/ychaouche/d1d4de5de1d7bf759982401cb7d68332/raw/081d0da2d65801fd3815511367a41b0ac094ac2a/gistfile1.txt
  • s

    Stefano Bonicatti

    07/20/2022, 1:14 PM
    Something I realized, you’re querying the process_events table but you need to enable events for that table too with 
    audit_allow_process_events
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:15 PM
    didn't have to on osqueryi
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:16 PM
    is that a flag?
  • s

    Stefano Bonicatti

    07/20/2022, 1:16 PM
    actually nvm, you’re right, the default is true
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:16 PM
    $ sudo osqueryi --disable_audit=false  --audit_allow_config=true --events_max=50000 --audit_allow_sockets --disable_events=false
Using a virtual database. Need help, type '.help'
osquery> select action, process_events.path, cmdline, socket_events.status, remote_address, remote_port, datetime(socket_events.time,'unixepoch') from socket_events join process_events on socket_events.pid = process_events.pid;
osquery> select action, process_events.path, cmdline, socket_events.status, remote_address, remote_port, datetime(socket_events.time,'unixepoch') from socket_events join process_events on socket_events.pid = process_events.pid;
+---------+---------------+-----------------+-------------+-----------------+-------------+------------------------------------------+
| action  | path          | cmdline         | status      | remote_address  | remote_port | datetime(socket_events.time,'unixepoch') |
+---------+---------------+-----------------+-------------+-----------------+-------------+------------------------------------------+
| connect | /usr/bin/curl | curl <http://google.com|google.com> | in_progress | 142.250.200.238 | 80          | 2022-07-20 12:59:12                      |
+---------+---------------+-----------------+-------------+-----------------+-------------+------------------------------------------+
osquery>

$
  • s

    Stefano Bonicatti

    07/20/2022, 1:18 PM
    @Yassine CHAOUCHE could you try again with the daemon but with 
    --events_optimize=false
    ?
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:23 PM
    spot on!
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:23 PM
    AND, it was recording events
  • y

    Yassine CHAOUCHE

    07/20/2022, 1:23 PM
    the old curl commands are there.
1...585960...70Latest