Hrm. I wonder about <https://github.com/osquery/os...
# cores
seph
03/15/2023, 1:49 PM
Hrm. I wonder about https://github.com/osquery/osquery/pull/7803
z
zwass
03/15/2023, 4:20 PM
Is it happening just once or multiple times?
s
seph
03/15/2023, 5:09 PM
This was happening on a customer site, so I don’t have full debug logs. But it looked like it was happening for every execution
seph
03/15/2023, 5:09 PM
I’m going to need to make a test case
b
Brad Girardeau
03/15/2023, 6:12 PMSorry yes I think it is a bug in #7803 - I posted a quick PR to give an idea: https://github.com/osquery/osquery/pull/7958
I can report back later when I'm able to reproduce/test this if you don't get to it first
s
seph
03/15/2023, 9:48 PM
Thanks for jumping on that! I don’t have a simple test case, but if you can test it we can roll out a 5.8.2
b
Brad Girardeau
03/17/2023, 8:52 PMSounds good! I should have time this afternoon to figure out how to test it
Brad Girardeau
03/17/2023, 10:46 PMOK left a comment on the PR, it seemed to work! Let me know if there's any other scenarios we should test.
It was a miss on my part in not testing the original PR #7803 enough - I'm feeling more comfortable setting up different local test cases now and will try to be more thorough for future changes 🙂
6 Views