@Stefano Bonicatti 😄

I think watcher looks for worker process called osquery. This is hardcoded in code unless it was changed recently

Oh dang 😞, I thought that there must have been something like that because I tried before and it didn't work

Does it work if you disable the watch dog?

@seph heh that would have been a good idea to try, however I want the watchdog anyway to guard the mem usage especially so I think for now I am going to abandon this pursuit.

Might be worth trying. Less as a long term answer, more as an experiment.

@seph true I will try it once I get my nginx config for fleet sorted

The watchdog, as far as checking CPU and memory, is not impacted by the change of name, because since the worker is a fork of the watchdog, it knows its pid, and uses that to filter down the process. One of the problems that there is and that I was referring to during the office hours though, is that we use a pidfile to track the watcher (only, to be fixed to track the worker too) and that is done because we don't want to have two instances of osquery running (for various reasons, mainly the RocksDB database). To identify that the pid corresponds to an osquery process, we use the process name, so if we change that, then we are not able to prevent that anymore. There might be various reasons why a previous osquery instance is still running, beyond actively launching osquery two times, but mainly revolve around bugs/hangs or long running queries and osquery asked to restart, but not acting fast enough, due to the long running query.

can you please explain how to do this on a mac and also how to extract

osqueryd.exe

from `.ms`i installer(like did you mean that you installed the osqueryd and then went to

osuqery/osqueryd

folder and then renamed it to

sc.exe

?

@Madhur Jodhwani if you've renamed osqueryd.exe to sc.exe then I reckon you should cease at this point.

Did I do something wrong?