Hi all! We have an osquery extension based on osquery-go library. And it use a NewExtensionManagerServer pattern. It's when extension itself connects to osquery, create tables and so on. When osquery restarts it forget about the extension and new tables. But the extension thinks that nothing have changed. Maybe someone know an easy way to solve that. To my mind extension should try to check tables and if they doesn't exist, recreates them.
08/31/2022, 12:32 PM
I think you’re right — if you’re managing the extension’s outside of osquery’s extension process management, then the extension will “disconnect” when osquery restarts.
But I’m not sure where I’d fix it — One pattern here is for the extension to health check, and reconnect.
Doing that at the SDK level feels like it’s adding complexity. I might stick with doing it in extension code.