https://github.com/osquery/osquery logo
#general
Title
# general
j

James Pickett

05/03/2023, 10:55 PM
I'm working on a table where I had previously wanted a column to be required in a where clause, but have since dropped the requirement, I updated my
.table
file and rebuilt, but it's still acting like it requires the column. Wondering if there is another cmake command or something I need to use. Anyone got any ideas? here is my .table file:
Copy code
table_name("windows_search")
description("Run searches against the windows system index database.")
schema([
    Column("entity", TEXT, "index of entity"),
    Column("attribute", TEXT, "attribute"),
    Column("value", TEXT, "value"),
    Column("max_results", INTEGER, "maximum number of results returned by windows api"),
    Column("sort", TEXT, "sort for windows api"),
    Column("columns", TEXT, "additional columns to include"),
    Column("query", TEXT, "windows search query"),
])
implementation("system/windows/windows_search@genWindowsSearch")
build cmd:
Copy code
cmake --build . --config RelWithDebInfo --target codegen_native_tables --target codegen_foreign_tables
msg after building:
Copy code
PS C:\Users\james\repos\james-osquery\build> .\osquery\RelWithDebInfo\osqueryi.exe
Using a [1mvirtual database[0m. Need help, type '.help'
osquery> select * from windows_search;
W0503 15:52:55.837489 15656 virtual_table.cpp:975] Table windows_search was queried without a required column in the WHERE clause
W0503 15:52:55.839401 15656 virtual_table.cpp:986] Please see the table documentation: <https://osquery.io/schema/#windows_search>
Error: constraint failed
ultimately ended up removing it from CMakeList.txt building then putting it back
s

seph

05/04/2023, 8:18 PM
The issue is that the table specs go through code generation to produce the c++ code, and it’s not connected to whatever would notice the spec are updated. So codegen never reruns
The big hammer is to delete the build directory and start clean. There’s probably a more narrow rm
9 Views