slevchenko
12/07/2021, 11:52 AMI1207 13:47:10.155495 48644 virtual_sqlite_table.cpp:111] ATC table: Could not prepare database at path: "/etc/osquery/quarantine.db"
I1207 13:47:10.155580 48644 auto_constructed_tables.cpp:38] ATC Table: Unable to detect journal mode, applying default locking policy for path /etc/osquery/quarantine.db
I1207 13:47:10.155865 48644 virtual_sqlite_table.cpp:111] ATC table: Could not prepare database at path: "/etc/osquery/quarantine.db"
W1207 13:47:10.155910 48644 auto_constructed_tables.cpp:47] ATC Table: Error Code: 26 Could not generate data: Could not prepare database for path /etc/osquery/quarantine.db
I suspect that that's due to: https://github.com/osquery/osquery/issues/5225 since error message does mention journal mode
detection problem, but I'm not sure how to fix this from my side. Does anyone know how to fix\prevent such issues ?fritz
12/07/2021, 1:28 PMFROM
statementslevchenko
12/07/2021, 1:55 PMfritz
12/07/2021, 1:57 PMslevchenko
12/07/2021, 1:59 PMseph
12/07/2021, 2:32 PMslevchenko
12/07/2021, 2:49 PMfritz
12/07/2021, 3:01 PM\n
newlinesslevchenko
12/07/2021, 3:17 PMseph
12/07/2021, 3:55 PMslevchenko
12/07/2021, 4:41 PMCREATE table quarantine(
...
...
);
In my case statements were formatted by IDE, and worked in any python, sqlite client and IDE itself. That's why it was very hard to notice what was actually wrong.seph
12/09/2021, 3:29 AMread -r -d '' SQL <<'EOF'
CREATE TABLE testatc (
astring TEXT,
anum INT
);
INSERT INTO testatc(astring, anum)
VALUES
('a', 1),
('b', 2);
EOF
rm -f newlines.db
printf "$SQL" | sqlite3 newlines.db
rm -f nolines.db
printf "$SQL" | tr -d "\n" | sqlite3 nolines.db
will make two sqlite DBspemberton:osquery-atc-bug seph$ sqlite3 nolines.db .schema
CREATE TABLE testatc ( astring TEXT, anum INT);
pemberton:osquery-atc-bug seph$ sqlite3 newlines.db .schema
CREATE TABLE testatc (
astring TEXT,
anum INT
);
pemberton:osquery-atc-bug seph$ cat osq.conf
{
"auto_table_construction": {
"newlines": {
"query": "select astring, anum from testatc",
"path": "newlines.db",
"columns": [
"astring",
"anum"
]
},
"nolines": {
"query": "select astring, anum from testatc",
"path": "nolines.db",
"columns": [
"astring",
"anum"
]
}
}
}
osquery> select * from nolines;
+----------------------------------------+---------+------+
| path | astring | anum |
+----------------------------------------+---------+------+
| /Users/seph/osquery-atc-bug/nolines.db | a | 1 |
| /Users/seph/osquery-atc-bug/nolines.db | b | 2 |
+----------------------------------------+---------+------+
osquery> select * from newlines;
+-----------------------------------------+---------+------+
| path | astring | anum |
+-----------------------------------------+---------+------+
| /Users/seph/osquery-atc-bug/newlines.db | a | 1 |
| /Users/seph/osquery-atc-bug/newlines.db | b | 2 |
+-----------------------------------------+---------+------+
slevchenko
12/12/2021, 8:18 AM