Artem
01/26/2021, 8:15 AM--watchdog_memory_limit=300
--watchdog_utilization_limit=130
it will be more than default values for Watchdog restrictions for CPU and RAM?
I am asking because we tried to increase these values but got another situation with lot’s of denylisted queries.theopolis
01/26/2021, 6:21 PMArtem
01/26/2021, 6:30 PM--watchdog_memory_limit=400
--watchdog_utilization_limit=250
But still we get a lot of logs with message: ” Scheduled query may have failed…“.
I don’t understand the reason at all.
Our osquery.flags content (example for windows):
--enroll_secret_path=C:\Program Files\osquery\enroll_secret
--tls_server_certs=C:\Program Files\osquery\server.pem
--tls_hostname=<censored>
--pidfile=C:\Program Files\osquery\osqueryd.pidfile
--host_identifier=hostname
--enroll_tls_endpoint=/api/v1/osquery/enroll
--config_plugin=tls
--config_tls_endpoint=/api/v1/osquery/config
--config_refresh=60
--disable_distributed=false
--disable_events=true
--disable_extensions=true
--disable_tables=curl
--distributed_plugin=tls
--distributed_interval=60
--distributed_tls_max_attempts=3
--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read
--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write
--logger_plugin=tls
--logger_tls_endpoint=/api/v1/osquery/log
--logger_tls_period=60
--watchdog_memory_limit=400
--watchdog_utilization_limit=250
Is it possible fo find the reason in status.logs?
If you tell me what information could be useful to you in order to understand the reason - write please, I think I can give it to you.SELECT * FROM osquery_schedule where denylisted='1' and name=<our query name>
and its results correspond to the logs, that is, queries are massively blocked again.
Looked through the status logs via ELK for a few selected clients, but found nothing to suggest the cause of the problem.
Is it possible to do some kind of debugging on a separate host? Is there any related information about watchdog work in general written to the logs?
So far, we see such situation on Windows, and we have not yet updated on MacBooks in large quantities.
For understanding, we use native osquery and fleetzwass
01/27/2021, 4:05 PMArtem
01/27/2021, 4:31 PMzwass
01/27/2021, 4:56 PMMaximum sustainable CPU...
or Memory limits exceeded...
logs in stderr.Artem
01/29/2021, 11:31 AMtheopolis
01/30/2021, 5:12 PMArtem
02/01/2021, 4:44 PMtheopolis
02/01/2021, 10:16 PMArtem
02/02/2021, 5:09 PMtheopolis
02/02/2021, 5:36 PMosquery.flags
file is not working. If you have a scheduled query against osquery_info
then you can verify the watchdog is disabled by checking the watcher
column, it should be -1
.Artem
02/02/2021, 7:26 PMSELECT * FROM osquery_flags where name='disable_watchdog'
and I see that disabling the watchdog was not applied correctly through the SCСM.
Here is config osquery.flags from one of our users.
We tried to restart osqueryd via SCCM and manually.
But after all this, I see that disabling the watchdog is still not applicable.
We are dealing with this now.