Andre Pinter

09/27/2022, 8:49 PM
Hey folks, I'm writing a carve endpoint for our osquery server, but I'm confused on the format I should be returning errors to the client in. Any pointers here? I've been reading through the docs trying to find the answer too
8:56 PM
I'm pretty sure it should just be
{"message":"a message","status":1}
, I could also be misinterpreting the client code for how it's supposed to log errors from the carve start endpoint


09/27/2022, 9:13 PM
That sounds about right.

Andre Pinter

09/27/2022, 10:17 PM
Okay, I'm still a bit lost here. I'm expecting https://github.com/osquery/osquery/blob/master/osquery/carver/carver.cpp#L220 to log something when my server returns an error code of 500 and a body like above w/ a json content type
10:17 PM
and i have verbose on
10:18 PM
the client seems to not return when i expect and instead hits https://github.com/osquery/osquery/blob/master/osquery/carver/carver.cpp#L322