QQ I have a process that spawns osqueryd and I want my proce osquery #general

QQ, I have a process that spawns osqueryd and I wa...

Amit Shani

08/26/2025, 1:22 PM

QQ, I have a process that spawns osqueryd and I want my process to also be the config extension of osqueryd. If I pass

--config_plugin=mycustomconfig

I’ll get an error saying this plugin is unknown. The example I know to work with config plugin work the opposite way:

Copy code

./osqueryd --extension /path/to/config.ext --config_plugin=mycustomconfig

but in this case osqueryd needs to spawn the extension binary. Is there any approach in which I can run osqueryd and register myself as config plugin without making it spawn a different process?

Stefano Bonicatti

08/26/2025, 4:56 PM

You can use

--extensions_require=mycustomconfig

to have osquery wait indefinitely for that plugin to register itself.

Stefano Bonicatti

08/26/2025, 4:57 PM

to my memory that should ensure that the config plugin name isn't checked until the extension has been registered too.

seph

08/27/2025, 2:43 AM

I think Stefano is correct.

seph

08/27/2025, 2:46 AM

At a high level, osquery can start a socket for extension communication. And then the extentions use that socket to register with osquery (and subsequent communication goes over the extension's socket) the

--extension

argument has osquery spawn the extension binary with the expected arguments. To invert that, you need to make sure osquery is listening on the the socket path you expect, and have your thing go and use it. Options like

config_plugin

tell osquery to use the extension that registered with that name for the config. But do nothing to actually start the extension. You'l want

extensions_require

so that osquery pauses it's startup waiting for those extensions to register

Amit Shani

08/27/2025, 7:33 AM

Thank you so much 🙏 I’ll give it a go much appreciated

Amit Shani

08/27/2025, 8:11 AM

update: works like a charm!

20 Views

Open in Slack

Previous Next