osqueryd is erroring out throwing following error for few of

Question

osqueryd is erroring out throwing following error for few of the queries I am trying to run ErrorLogTag read unix u003e var osquery sock osquery em i o timeout level error Is there anything that I need to change in config file What can I do to resolve this error worker threads has been set to 4 currently worker threads 4

seph · Answer

I would expect that socket to be used to communicate to extensions Are your queries using tables that come from an extension

AP · Answer

This is happening for all tables Like tables as basic as syslog events

AP · Answer

journalctl logs for osqueryd shows the followiing log entries 5914 eventsubscriberplugin cpp 577 Removed 212 event batches with 18446744073709551422 delete errors for subscriber syslog syslog events limit 100000 last query never

AP · Answer

journalctl logs error has been resolved by deleting the db and restarting the service

AP · Answer

But strangely ErrorLogTag read unix u003e var osquery sock osquery em i o timeout level error is still showing up for some queries randomly Like in one run for some queries there is no error and for some queries this error creeps up I m unable to understand why

AP · Answer

I see this majorly happening on syslog events last and process open sockets tables And not on file events hardware events and usb devices tables These are all the tables I am using so far

AP · Answer

But a few seconds ago even syslog events last and process open sockets tables queries ran and gave the desired outputs But not anymore

AP · Answer

Now syslog events last and process open sockets tables are only throwing ErrorLogTag read unix u003e var osquery sock osquery em i o timeout level error

seph · Answer

Is this osqueryi or osqueryd Are you using any extensions What options are you running with

AP · Answer

This is osqueryd Not getting this error when I ran with osqueryi This is what osqueryd is using usr bin osqueryd flagfile etc osquery osquery flags config path etc osquery osquery conf I don t see any use of extensions though This is how the flags file look cat osquery flags extensions socket= var osquery sock osquery em watchdog memory limit=1000

Divya · Answer

< seph> these are the options we use

Divya · Answer

``` host identifier PLACEHOLDER HOSTNAME schedule splay percent 10 config plugin filesystem logger plugin filesystem logger path var log osquery disable logging false pidfile var osquery osquery pidfile events expiry 1 database path var osquery osquery db worker threads 4 disable events false disable audit false audit allow config true enable syslog true syslog pipe path var osquery syslog pipe force true audit allow sockets true enable file events true enable ntfs publisher true schedule default interval 3600 ```

Divya · Answer

our queries run on a schedule and these errors are happeing when osquery is running on deamon mode Strange part is we are able to open the socket successfully

Divya · Answer

but the query is giving these errors

seph · Answer

I don t think I ve seen this before In another thread here AP has talked about docker and other things Is there anything unusual happening here

Divya · Answer

we trigger the queries from inside a docker container but I believe that should not be an issue

Divya · Answer

as the errors are random How many parallel threads can osquery handle Is that decided by worker threads 4 Are there guidelines on setting this number