I observed a weird issue on Windows; wondering if I’m doing something wrong or is it an actual bug. My custom extension using the Golang SDK which runs on macOS, Linux and Windows. The issue is triggered when I use

DoubleColumn

type and the extension is being invoked via the daemon process and logging to

osqueryd.results.log

. If I run the same query in interactive mode (osqueryi), it prints that column as expected. So I would assume it should be the same when it logs to a file, however in the

osqueryd.results.log

the value of that column will always result to empty. To further troubleshoot the issue I made sure that I print the same value in two types of columns, one

DoubleColumn

and one

TextColumn

. The

TextColumn

was not empty when being logged to file, whilst the

DoubleColumn

is empty. Note that other type of columns as well are being printed to the log file as they should, e.g.

IntegerColumn

. On Unix systems it works as it should, whilst on Windows no. Below some snippets to illustrate the issue:

return []table.ColumnDefinition{
		table.DoubleColumn("value1"),
		table.TextColumn("value2"),
	}
---------
	var value float32
	value = 4.12345678
	return []map[string]string{
		{
			"value1": fmt.Sprintf("%.4f", value),
			"value2": fmt.Sprintf("%.4f", value),
		},
	}