Title
#windows
MoodyMudit

MoodyMudit

04/13/2022, 9:58 AM
Hi, I am using the
hash
table in windows and trying to fetch the
sha1
of a few files. However, for some files, I do receive the correct data, while for others I don’t. Can someone please help me understand if there is any reason that I don’t receive the data for some files? I don’t receive the sha1 of
windowsdesktop-runtime-5.0.15-win-x86.exe
while I do get the sha1 of
svchost.exe
Stefano Bonicatti

Stefano Bonicatti

04/13/2022, 10:03 AM
Hello @MoodyMudit it’s likely that the file size exceeds the default read_max value that osquery has, which prevents too many resources to be used. You might want to increase that value.
10:04 AM
osquery will also issue a warning when that happens
MoodyMudit

MoodyMudit

04/13/2022, 10:05 AM
Got it. Thanks a lot Stefano for the quick response.
Stefano Bonicatti

Stefano Bonicatti

04/13/2022, 10:05 AM
“Cannot read <file path> size exceeds limit: <file size> > <limit>
10:06 AM
No problem! (Also, the default limit is 50MB)