Channels
android_tests
apple-silicon
arm-architecture
auditing-warroom
aws
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
general
golang
goquery
infrastructure
jobs
kolide
linen-dev
linux
macos
officehours
osctrl
plugins
process-auditing
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Title
s
Subash Rajaa
10/17/2022, 1:22 PMvoid run() {
size_t waited = 0;
while (true) {
if (interrupted()) {
return;
}
std::this_thread::sleep_for(std::chrono::milliseconds(200));
waited += 200;
if (waited > FLAGS_alarm_timeout * 1000) {
fflush(stdout); //==> FIX
Initializer::shutdownNow(EXIT_CATASTROPHIC);
}
}
}
v
Vivek Uppal
10/17/2022, 2:47 PMIf this is appropriate for a different channel, please let us know and we can move the conversation there.
If it would be helpful
Subash could we link the files here, where we are proposing the change
s
Subash Rajaa
10/17/2022, 3:32 PMSure.
osquery\core\init.cpp
diff --git a/osquery/core/init.cpp b/osquery/core/init.cpp
index 3b9c245c..3f82ecd8 100644
--- a/osquery/core/init.cpp
+++ b/osquery/core/init.cpp
@@ -684,6 +684,7 @@ class AlarmRunnable : public InterruptibleRunnable {
std::this_thread::sleep_for(std::chrono::milliseconds(200));
waited += 200;
if (waited > FLAGS_alarm_timeout * 1000) {
+ fflush(stdout);
Initializer::shutdownNow(EXIT_CATASTROPHIC);
}
}
v
Vivek Uppal
10/18/2022, 2:24 PMIs this a better question for #windows channel
s
seph
10/19/2022, 4:16 AMGiven that there’s a suggested diff here, this is probably best in a github pull request.
You could file it in an issue if thats easier
s
Subash Rajaa
10/19/2022, 11:47 AMThanks
v
Vivek Uppal
10/19/2022, 7:47 PMHey Seph! great to e-meet you again
s
seph
10/19/2022, 7:48 PMI thought that might be you Vivek! Nice to say hi. I’m still here, much the same. How’s Carbon Black treating you?
v
Vivek Uppal
10/19/2022, 7:48 PMPretty good, couldn't ask for more. It is a fun env!
s
seph
10/19/2022, 7:49 PMMost we can hope for. That and growth oppertunities
v
Vivek Uppal
10/19/2022, 7:50 PMSo the open source contribution aspects for us is a little onerous given the corporate lay of the land around here
@Subash Rajaa has tried this patch internally and it works for the use case he outlined above. We are in a situation where we have to patch this one line every time we decide to upgrade the shipping version of osquery with our product
We are wondering if there might be a way to get this change into mainline
s
seph
10/19/2022, 7:55 PMSo your corporate makes it hard to sign off on a CLA? That makes it hard to accept patches 😐
Can y’all file issues or does that bump into corporate?
v
Vivek Uppal
10/19/2022, 7:56 PMhmm.. filing issues would be ok I believe. Let me check on that
s
seph
10/19/2022, 7:57 PMIf you can file an issue, file it, and maybe don’t include the patch? (It should be fairly obvious from needing a flush)
If you can’t, I’ll file it
v
Vivek Uppal
10/19/2022, 7:58 PMAppreciate the help man. I will get back on this
s
seph
10/19/2022, 7:58 PMAgree on getting it fixed. Now it’s just logistics 🙂
s
Subash Rajaa
10/20/2022, 2:42 PMthanks gentlemen for the help. Will file the issue and notify.