Artem
05/21/2023, 3:47 PM/var/osquery/osquery.db
removing helps, but temporarely.
I see this problem only on few specific hosts but right now I can’t determine the root cause of the issue. These hosts have the same OS as others and Osquery also has the same version and configuration (managed by Ansible)
You can see osquery.flags file here
--enroll_secret_path=<secret path>
--tls_hostname=<endpoint>:443
--host_identifier=hostname
--enroll_tls_endpoint=/api/osquery/enroll
--config_plugin=tls
--config_tls_endpoint=/api/osquery/config
--config_refresh=60
--disable_distributed=false
--distributed_plugin=tls
--distributed_interval=30
--distributed_tls_max_attempts=5
--distributed_tls_read_endpoint=/api/osquery/distributed/read
--distributed_tls_write_endpoint=/api/osquery/distributed/write
--logger_plugin=filesystem,tls
--logger_tls_endpoint=/api/osquery/log
--logger_tls_period=10
--logger_tls_max_linesize=20971520
--read_max=209715200
--table_delay=200
--disable_carver=false
--carver_disable_function=false
--carver_compression=true
--carver_start_endpoint=/api/osquery/carve/begin
--carver_continue_endpoint=/api/osquery/carve/block
--carver_block_size=2097152
--disable_extensions=true
--disable_events=true
I tried to play with several of these options but without results.
I don’t see rare messages in logs (after verbose logging enabling) after time when host stops to respond except the line
distributed.cpp:248] Removing expired running distributed query: cb8cee4e4232a54914034659b3b073d60d28a4c129b03eebc9dd536debcdec79
I can share logs from osquery for hours-days in DM, if you need them.
I will be very grateful for any help to specify and eliminate the problem!/api/osquery/distributed/read
and /api/osquery/distributed/write
endpointsMay 19 16:02
And the problems start about May 19 17:02
seph
Found 1 distributed queries marked as denylisted
is that the cause here?SELECT de.encrypted, m.path FROM disk_encryption de JOIN mounts m ON m
.device_alias = de.name;
Is that consistent across the various times it failed?Ryan Mack
05/22/2023, 1:58 PMseph
block_devices
and disk_encryption
tables around handling query context, and joins. It sounds like maybe you fixed them?Ryan Mack
05/22/2023, 2:00 PMseph
Ryan Mack
05/22/2023, 2:01 PMseph
Ryan Mack
05/22/2023, 2:02 PMseph
disk_encryption
is actually partly buggy. a coworker of mine is in the process of reverting partys of thatRyan Mack
05/22/2023, 2:06 PMseph
Artem
05/26/2023, 12:29 PM