Title
#general
b

Bryan Brewer

03/12/2021, 9:41 PM
hey trying to troubleshoot a table extension on ubuntu18 it works as expected when I manually load the extension. either via
osqueryi --extension /etc/osquery/foo.ext
or
osqueryi --nodisable_extensions
and other session
/usr/bin/python /etc/osquery/foo.ext --socket /root/.osquery/shell.em
the very same extension autoloads fine on an older box different distro... double checked the configs. they match on working and non-working endpoints. turned on --verbose, but all I see in the non-working logs is
/var/log/osquery/osqueryd.INFO.20210312-185550.13594:I0312 18:55:58.125411 13630 registry_factory.cpp:107] Extension 37844 registered table plugin foo
/var/log/osquery/osqueryd.INFO.20210312-203820.19041:I0312 20:38:29.640424 19081 interface.cpp:110] Registering extension (foo, 26890, version=1.0.0, sdk=1.8.0)
I see it registered
osquery> select * from osquery_extensions;
+-------+-------------------+---------+-------------+-------------------------------+-----------+
| uuid  | name              | version | sdk_version | path                          | type      |
+-------+-------------------+---------+-------------+-------------------------------+-----------+
| 0     | core              | 4.5.1   | 0.0.0       | /root/.osquery/shell.em       | core      |
| 35494 | foo               | 1.0.0   | 1.8.0       | /root/.osquery/shell.em.35494 | extension |
+-------+-------------------+---------+-------------+-------------------------------+-----------+
but when auto-loading
osquery> select * from foo;
Error: no such table: foo
just wondering if there's any other pointers out there that I'm not finding in the docs.
Mike Myers

Mike Myers

03/12/2021, 11:53 PM
Definitely odd, since it says it registered the table plugin. Can you confirm it will have this problem with the example extension, or any other extensions?
11:58 PM
You said it works fine when loading the extension manually in osqueryi. Also when loading the extension via the autoload file? How then, did you load it when you got the
no such table
error?