Artem01/26/2021, 8:15 AM
it will be more than default values for Watchdog restrictions for CPU and RAM? I am asking because we tried to increase these values but got another situation with lot’s of denylisted queries.
theopolis01/26/2021, 6:21 PM
Artem01/26/2021, 6:30 PM
But still we get a lot of logs with message: ” Scheduled query may have failed…“. I don’t understand the reason at all. Our osquery.flags content (example for windows):
Is it possible fo find the reason in status.logs? If you tell me what information could be useful to you in order to understand the reason - write please, I think I can give it to you.
--enroll_secret_path=C:\Program Files\osquery\enroll_secret --tls_server_certs=C:\Program Files\osquery\server.pem --tls_hostname=<censored> --pidfile=C:\Program Files\osquery\osqueryd.pidfile --host_identifier=hostname --enroll_tls_endpoint=/api/v1/osquery/enroll --config_plugin=tls --config_tls_endpoint=/api/v1/osquery/config --config_refresh=60 --disable_distributed=false --disable_events=true --disable_extensions=true --disable_tables=curl --distributed_plugin=tls --distributed_interval=60 --distributed_tls_max_attempts=3 --distributed_tls_read_endpoint=/api/v1/osquery/distributed/read --distributed_tls_write_endpoint=/api/v1/osquery/distributed/write --logger_plugin=tls --logger_tls_endpoint=/api/v1/osquery/log --logger_tls_period=60 --watchdog_memory_limit=400 --watchdog_utilization_limit=250
and its results correspond to the logs, that is, queries are massively blocked again. Looked through the status logs via ELK for a few selected clients, but found nothing to suggest the cause of the problem. Is it possible to do some kind of debugging on a separate host? Is there any related information about watchdog work in general written to the logs? So far, we see such situation on Windows, and we have not yet updated on MacBooks in large quantities. For understanding, we use native osquery and fleet
SELECT * FROM osquery_schedule where denylisted='1' and name=<our query name>
zwass01/27/2021, 4:05 PM
Artem01/27/2021, 4:31 PM
zwass01/27/2021, 4:56 PM
Maximum sustainable CPU...
logs in stderr.
Memory limits exceeded...
Artem01/29/2021, 11:31 AM
theopolis01/30/2021, 5:12 PM
Artem02/01/2021, 4:44 PM
theopolis02/01/2021, 10:16 PM
Artem02/02/2021, 5:09 PM
theopolis02/02/2021, 5:36 PM
file is not working. If you have a scheduled query against
then you can verify the watchdog is disabled by checking the
column, it should be
Artem02/02/2021, 7:26 PM
and I see that disabling the watchdog was not applied correctly through the SCСM. Here is config osquery.flags from one of our users. We tried to restart osqueryd via SCCM and manually. But after all this, I see that disabling the watchdog is still not applicable. We are dealing with this now.
SELECT * FROM osquery_flags where name='disable_watchdog'