sculley
08/30/2017, 8:47 AMSELECT * FROM process_open_sockets LIMIT 1; on?? so I can prove If i'm going insane or not?? I am having a hard time proving that fd/pid are correctly identified on these platforms. I even tried on a fresh install of Ubuntu last night.
[root@syseng-hello-app1 ~]# osqueryi --verbose --debug 'SELECT * FROM process_open_sockets LIMIT 1;'
I0830 08:40:41.837923 26613 init.cpp:392] osquery initialized [version=2.7.0]
I0830 08:40:41.838111 26613 extensions.cpp:288] Could not autoload extensions: Failed reading: /etc/osquery/extensions.load
I0830 08:40:41.838289 26613 init.cpp:615] Cannot start extension manager: Extensions disabled
I0830 08:40:41.838608 26613 init.cpp:651] Error reading config: config file does not exist: /etc/osquery/osquery.conf
I0830 08:40:41.838802 26613 events.cpp:1077] Error registering subscriber: socket_events: Subscriber disabled via configuration
+-----+----+--------+--------+----------+---------------+----------------+------------+-------------+------+
| pid | fd | socket | family | protocol | local_address | remote_address | local_port | remote_port | path |
+-----+----+--------+--------+----------+---------------+----------------+------------+-------------+------+
| -1 | -1 | 9572 | 2 | 6 | 0.0.0.0 | 0.0.0.0 | 111 | 0 | |
+-----+----+--------+--------+----------+---------------+----------------+------------+-------------+------+
If someone can show me either pid/fd showing as a value other than -1, I will give you a virtual 🍺! I have ran this now on over 300 different boxes along with multiple distributions with the same results. 😞 😞