annec06/08/2021, 4:09 PM
in osqueryd syslogs. It comes from ExtensionManagerInterface::registerExtension. The issue usually solves itself after a few retries, but not always.
"Refusing to register duplicate extension "
seph06/09/2021, 12:31 AM
annec06/09/2021, 4:25 PM
I think the issue comes from the following sequence of events: 1. osqueryd starts an extension and a watcher that will ping the extension regularly to see if it's still alive 2. the extension name is added to osqueryd's register (the uuid is not relevant here) 3. for "reason" the extension dies and shuts down properly 4. the extension is restarted and tries to register its name and be granted a uuid 5. the watcher hasn't had time to try to ping and remove the old extension from the register 6. the error shows up.
extensions.cpp:] Found autoloadable extension: watcher.cpp:] Created and monitoring extension child (18659): interface.cpp:] Extension manager service starting: /var/osquery/osquery.em our extension logs it's starting with pid 18659 interface.cpp:] Registering extension (ais_audit_client, 36068, version=, sdk=) our extension logs it dies watcher.cpp:] Created and monitoring extension child (18840): interface.cpp:] Refusing to register duplicate extension our extension, through osquery-go shows the error status 1 registering extension: Duplicate extension registered
seph06/14/2021, 10:02 PM
zwass06/14/2021, 10:10 PM
seph06/14/2021, 10:11 PM
annec06/14/2021, 10:22 PM
zwass06/14/2021, 10:23 PM
annec06/14/2021, 11:07 PM
endpoint mentioned in the osquery specs https://github.com/osquery/osquery/blob/master/osquery/extensions/interface.h#L65-L78, but missing from the osquery-go library https://github.com/osquery/osquery-go/blob/master/client.go#L14-L23. I'd be happy to share what I have done, but also wondering if there is a good reason it is missing in the first place
zwass06/14/2021, 11:24 PM