Bryan Brewer
03/12/2021, 9:41 PMosqueryi --extension /etc/osquery/foo.ext
or
osqueryi --nodisable_extensions
and other session /usr/bin/python /etc/osquery/foo.ext --socket /root/.osquery/shell.em
the very same extension autoloads fine on an older box different distro...
double checked the configs. they match on working and non-working endpoints.
turned on --verbose, but all I see in the non-working logs is
/var/log/osquery/osqueryd.INFO.20210312-185550.13594:I0312 18:55:58.125411 13630 registry_factory.cpp:107] Extension 37844 registered table plugin foo
/var/log/osquery/osqueryd.INFO.20210312-203820.19041:I0312 20:38:29.640424 19081 interface.cpp:110] Registering extension (foo, 26890, version=1.0.0, sdk=1.8.0)
I see it registered
osquery> select * from osquery_extensions;
+-------+-------------------+---------+-------------+-------------------------------+-----------+
| uuid | name | version | sdk_version | path | type |
+-------+-------------------+---------+-------------+-------------------------------+-----------+
| 0 | core | 4.5.1 | 0.0.0 | /root/.osquery/shell.em | core |
| 35494 | foo | 1.0.0 | 1.8.0 | /root/.osquery/shell.em.35494 | extension |
+-------+-------------------+---------+-------------+-------------------------------+-----------+
but when auto-loading
osquery> select * from foo;
Error: no such table: foo
just wondering if there's any other pointers out there that I'm not finding in the docs.Mike Myers
03/12/2021, 11:53 PMno such table
error?