Matt Ackard

12/17/2020, 5:26 PM
Hello, I'm troubleshooting the following error in osquery
E1216 18:35:38.019801 18135 udev.cpp:91] udev monitor returned invalid device
I1216 18:35:38.020171 18135 events.cpp:802] Event publisher udev run loop terminated for reason: udev monitor failed.
The original osquery version where I found this issue was 3.3.2, but I tried creating an instance using 4.5.1 and still had the same issue. When osquery is started/restarted, queries will run normally for a few minutes and then all query output to the results and snapshot logs will stop. Restarting will follow the same pattern. It looks like it may be linked to running a large number of docker containers since if I create another instance without adding any containers it runs normally. The udev error above prints after about 2 hours from the last INFO log output. Does anyone know what is causing this issue and if there is a fix? This is on linux servers.


12/18/2020, 3:34 AM
I've not seen this but my guess is the udev message is a symptom of an underlying resource availability issue.