could anyone help to explain what behavior occurs behind the query of "select * from routes where destination = '0.0.0.0'"? we are suffering from the issue when we are running it in osqueryi and it just stuck, even worse it will bring down the agent.

Is this on Linux? If the agent is brought down there's a crash; it would be useful to get a stack trace via gdb (or a core dump). As for the table itself (if on Linux), it queries the kernel via a Netlink socket, getting how the routes are set up, but it's not communicating remotely with anything.

yes

I see, still sounds like a bug; can't say right away but although it's using

poll

to prevent blocking and waiting indefinitely on the socket, there might still be a bug in the logic.

i saw osquery has a patch fixed some issue similar, i will try that patch first to see whether it can work. if not, i will come back to you. ty

There was a known bug fixed quite a while ago that caused this issue. I know it is fixed between 5.5.1 and 5.8.2. 🙂