Should I have to do anything special to use an extension table in a discovery query for a pack?

Can you try with --verbose to make sure the table is actually there? There are some differences in the sanity checks of osqueryd vs osqueryi

Put --verbose in the flags file?

Yes, that will print additional debugging information that could help diagnose the problem

Okay, so , in order (and skipping things that don't seem relevant): 1. Found autoloadable extension: <the relevant one> 2. Executing watcher 3. Created and monitoring child (13347) for the relevant extension 4. osquery worker initialized 5. Adding new service: extensionwatcher 6. Extension manager service starting 7. Discovery failed ... no such table 8. Registering extension (relevant one)

you can use --extensions_require=plugin_name

Thanks so much for the help; trying that, will let you know.

Extensions are processes that communicate with osquery via Thrift; the --extensions_interval is passed down to extensions when osquery starts them as

--interval value

, and it's a connectivity check performed client side

Oh, thanks! I'm getting a "Discovery query failed", and looking at the source:

for (const auto& q : discovery_queries_) {
  SQL results(q);
  if (!results.ok()) {
    LOG(WARNING) << "Discovery query failed (" << q
                 << "): " << results.getMessageString();
    discovery_cache_.second = false;
    break;
  }
  if (results.rows().size() == 0) {
    discovery_cache_.second = false;
    break;
  }
}
return discovery_cache_.second;