Hi wave Has anyone seen an issue with GCP hosts not returnin osquery #general

Hi :wave: Has anyone seen an issue with GCP hosts ...

Ryan

03/31/2023, 2:21 PM

Hi 👋 Has anyone seen an issue with GCP hosts not returning any information in the

cpu_info

table? I opened a GitHub issue about it, but might be easier to chat here: https://github.com/osquery/osquery/issues/7976

Stefano Bonicatti

03/31/2023, 2:45 PM

Hey @Ryan, the

cpu_info

table takes its information from the SMBIOS tables, which in a virtualized system are emulated. Maybe that information is missing.

Stefano Bonicatti

03/31/2023, 2:46 PM

You could try to check what

sudo dmidecode -t processor

gives; also running osquery with

--verbose

might provide more information if something is not working.

Ryan

04/03/2023, 8:34 AM

Thanks for the tip, I’ll take a look at that!

Ryan

04/03/2023, 8:35 AM

Copy code

osquery> select * from cpu_info;
I0403 08:35:27.250139 27557 smbios_tables.cpp:106] Reading SMBIOS from sysfs DMI node

Ryan

04/03/2023, 8:36 AM

And the output from the

dmidecode

command:

Copy code

$ sudo dmidecode -t processor
# dmidecode 3.1
Getting SMBIOS data from sysfs.
SMBIOS 2.4 present.

Handle 0x1001, DMI type 4, 32 bytes
Processor Information
	Socket Designation: CPU 1
	Type: Central Processor
	Family: Other
	Manufacturer: Google
	ID: 57 06 05 00 FF FB 8B 1F
	Version: Not Specified
	Voltage: Unknown
	External Clock: Unknown
	Max Speed: 2000 MHz
	Current Speed: 2000 MHz
	Status: Populated, Enabled
	Upgrade: Other
	L1 Cache Handle: Not Provided
	L2 Cache Handle: Not Provided
	L3 Cache Handle: Not Provided

Handle 0x1002, DMI type 4, 32 bytes
Processor Information
	Socket Designation: CPU 2
	Type: Central Processor
	Family: Other
	Manufacturer: Google
	ID: 57 06 05 00 FF FB 8B 1F
	Version: Not Specified
	Voltage: Unknown
	External Clock: Unknown
	Max Speed: 2000 MHz
	Current Speed: 2000 MHz
	Status: Populated, Enabled
	Upgrade: Other
	L1 Cache Handle: Not Provided
	L2 Cache Handle: Not Provided
	L3 Cache Handle: Not Provided

Handle 0x1003, DMI type 4, 32 bytes
Processor Information
	Socket Designation: CPU 3
	Type: Central Processor
	Family: Other
	Manufacturer: Google
	ID: 57 06 05 00 FF FB 8B 1F
	Version: Not Specified
	Voltage: Unknown
	External Clock: Unknown
	Max Speed: 2000 MHz
	Current Speed: 2000 MHz
	Status: Populated, Enabled
	Upgrade: Other
	L1 Cache Handle: Not Provided
	L2 Cache Handle: Not Provided
	L3 Cache Handle: Not Provided

Handle 0x1004, DMI type 4, 32 bytes
Processor Information
	Socket Designation: CPU 4
	Type: Central Processor
	Family: Other
	Manufacturer: Google
	ID: 57 06 05 00 FF FB 8B 1F
	Version: Not Specified
	Voltage: Unknown
	External Clock: Unknown
	Max Speed: 2000 MHz
	Current Speed: 2000 MHz
	Status: Populated, Enabled
	Upgrade: Other
	L1 Cache Handle: Not Provided
	L2 Cache Handle: Not Provided
	L3 Cache Handle: Not Provided

Stefano Bonicatti

04/06/2023, 6:28 PM

hey @Ryan, thanks for checking; would it be possible to put this information also in the issue? It indeed seems that something might be wrong with either how the table reads the data or how GCP exposes it.

Stefano Bonicatti

04/06/2023, 6:29 PM

I mean SMBIOS seems to be there, but there might be something in the structure that’s not expected (but osquery is silent on this).

Ryan

04/11/2023, 9:42 AM

sure

Ryan

04/11/2023, 9:44 AM

done 🙂

Open in Slack

Previous Next