ccombs
02/04/2021, 3:50 PMfritz
02/04/2021, 4:32 PMccombs
02/04/2021, 5:37 PMselect p.name, p.path, lp.port, lp.address, lp.protocol from listening_ports lp LEFT JOIN processes p ON lp.pid = p.pid WHERE lp.port != 0 AND p.name != '';
fritz
02/04/2021, 5:48 PMccombs
02/04/2021, 6:31 PMfritz
02/04/2021, 7:38 PMccombs
02/05/2021, 2:59 PMfritz
02/05/2021, 3:36 PMSELECT * FROM system_info
)
3. If other queries return quickly and it is limited to this listening ports query, start breaking apart the query into individuals tables (eg. SELECT * FROM processes
, SELECT * FROM listening_ports
)
4. If possible, put physical hands on one of the repeat offending devices and determine, is this behavior reproducible when querying the device locally (eg. in osqueryi)
5. If it is reproducible in osqueryi, run osqueryi with .timer ON
flag and perhaps the EXPLAIN QUERY PLAN
command to see if you can chase down the source of the response delay.
6. Establish a pattern for why some CentOS devices are susceptible to this effect and others are not.ccombs
02/08/2021, 4:37 PMseph
02/22/2021, 4:13 AM