Artem05/21/2023, 3:47 PM
removing helps, but temporarely. I see this problem only on few specific hosts but right now I can’t determine the root cause of the issue. These hosts have the same OS as others and Osquery also has the same version and configuration (managed by Ansible) You can see osquery.flags file here
I tried to play with several of these options but without results. I don’t see rare messages in logs (after verbose logging enabling) after time when host stops to respond except the line
--enroll_secret_path=<secret path> --tls_hostname=<endpoint>:443 --host_identifier=hostname --enroll_tls_endpoint=/api/osquery/enroll --config_plugin=tls --config_tls_endpoint=/api/osquery/config --config_refresh=60 --disable_distributed=false --distributed_plugin=tls --distributed_interval=30 --distributed_tls_max_attempts=5 --distributed_tls_read_endpoint=/api/osquery/distributed/read --distributed_tls_write_endpoint=/api/osquery/distributed/write --logger_plugin=filesystem,tls --logger_tls_endpoint=/api/osquery/log --logger_tls_period=10 --logger_tls_max_linesize=20971520 --read_max=209715200 --table_delay=200 --disable_carver=false --carver_disable_function=false --carver_compression=true --carver_start_endpoint=/api/osquery/carve/begin --carver_continue_endpoint=/api/osquery/carve/block --carver_block_size=2097152 --disable_extensions=true --disable_events=true
I can share logs from osquery for hours-days in DM, if you need them. I will be very grateful for any help to specify and eliminate the problem!
distributed.cpp:248] Removing expired running distributed query: cb8cee4e4232a54914034659b3b073d60d28a4c129b03eebc9dd536debcdec79
And the problems start about
May 19 16:02
May 19 17:02
seph05/22/2023, 1:34 AM
is that the cause here?
Found 1 distributed queries marked as denylisted
Is that consistent across the various times it failed?
SELECT de.encrypted, m.path FROM disk_encryption de JOIN mounts m ON m .device_alias = de.name;
Ryan Mack05/22/2023, 1:58 PM
seph05/22/2023, 2:00 PM
tables around handling query context, and joins. It sounds like maybe you fixed them?
Ryan Mack05/22/2023, 2:00 PM
seph05/22/2023, 2:01 PM
Ryan Mack05/22/2023, 2:01 PM
seph05/22/2023, 2:01 PM
Ryan Mack05/22/2023, 2:02 PM
seph05/22/2023, 2:06 PM
is actually partly buggy. a coworker of mine is in the process of reverting partys of that
Ryan Mack05/22/2023, 2:06 PM
seph05/22/2023, 2:07 PM
Artem05/26/2023, 12:29 PM