Any solution for vtable constructor failed for osq...
# fleeta
Atish Dubey
03/09/2025, 5:35 AMAny solution for vtable constructor failed for osquery extensions on Windows.
E0308 214145.789654 19388 scheduler.cpp:128] Error executing scheduled query pack/Global/active windows query: vtable constructor failed: active_windows;
k
Kathy Satterlee
03/10/2025, 3:25 PMHi @Atish Dubey! I'd look at the osquery logs for anything around startup that might indicate why the extension isn't working as expected. If you aren't seeing anything when extensions are loading, it may be useful to enable verbose logging as well.
a
Atish Dubey
03/12/2025, 5:33 AM@Kathy Satterlee I can constantly see this error--
[PYI-7752:ERROR] Failed to execute script 'windows_wifi_details' due to unhandled exception!
Traceback (most recent call last):
File "windows_wifi_details.py", line 3, in <module>
File "<frozen importlib._bootstrap>", line 1360, in _find_and_load
File "<frozen importlib._bootstrap>", line 1331, in _find_and_load_unlocked
File "<frozen importlib._bootstrap>", line 935, in _load_unlocked
File "PyInstaller\loader\pyimod02_importers.py", line 384, in exec_module
File "osquery\__init__.py", line 38, in <module>
File "<frozen importlib._bootstrap>", line 1360, in _find_and_load
File "<frozen importlib._bootstrap>", line 1331, in _find_and_load_unlocked
File "<frozen importlib._bootstrap>", line 935, in _load_unlocked
File "PyInstaller\loader\pyimod02_importers.py", line 384, in exec_module
File "osquery\management.py", line 45, in <module>
File "<frozen os>", line 714, in getitem
KeyError: 'PROGRAMDATA'
Atish Dubey
03/18/2025, 9:42 AM@Kathy Satterlee Hey, can you please take a look at this above log, constantly i do see this log and no such table for the extensions.
k
Kathy Satterlee
03/18/2025, 2:17 PMIs this the only extension that’s failing? If so, where did this extension come from? It appears as though there may be a bug in the extension.
a
Atish Dubey
03/18/2025, 5:53 PM@Kathy Satterlee The extension is fetched from tuf server while installing the fleet agent, but the extension working locally via both osqueryi and osqueryd but not from the fleet ui.
k
Kathy Satterlee
03/18/2025, 9:00 PMIt could be that there's a permissions error, a missing argument expected by the extension, or something that's at un unexpected path. I'd be happy to take a look at the full logs if you'd like to share those (feel free to DM me with them, I know there's potentially a lot to redact) to see if anything pops up there. Is this an internally developed tool? If not, I'd also be happy to test myself if you'd like to point me in the right direction.
3 Views