https://github.com/osquery/osquery logo
Title
d

demonbhao

08/31/2020, 6:31 AM
hello I modified the osquery side. After the conf file cannot be in the/var/log/osquery/osquery result. See the log log is this why?
a

alessandrogario

08/31/2020, 9:08 AM
Hello @demonbhao! I'm assuming the issue is that there are no log/results file created; can you try to create the /var/log/osquery folder and then try again?
d

demonbhao

08/31/2020, 9:12 AM
No, I have /var/log/osquery Osquery.conf will no longer generate logs after modifying the previous ability to generate logs
Hello, how can I solve this problem?Osquery.conf cannot produce the log of the query even if it is modified according to the official document
t

theopolis

08/31/2020, 11:49 AM
It looks like your configuration contains invalid JSON. Check the systemd output for the osqueryd service and you will see the error.
d

demonbhao

08/31/2020, 12:45 PM
Sorry, I'm a rookie. How do I check for error output
t

theopolis

08/31/2020, 3:10 PM
You can try
systemctl status osqueryd
or
osqueryd --config_check --config_dump
but that
/etc/osquery/osquery.conf
must be valid JSON, are you familiar with JSON formatting? Do you have experience with tools like
jq
to help you check the format?
d

demonbhao

09/01/2020, 1:43 AM
Okay, so I'm going to check my JSON format again Thank you very much for your help this time Best wishes
hello I checked the JSON format and changed the errors and looked at the service and found no problem but still couldn't generate the log Here are the results of my check with the command: [root@sze0-sec-test-1006 osquery]# osqueryd --config_check --config_dump I0901 10:08:02.557000 29037 rocksdb.cpp:148] Rocksdb open failed (5:0) IO error: While lock file: /var/osquery/osquery.db/LOCK: Resource temporarily unavailable W0901 10:08:02.557262 29037 database.cpp:77] Failed to activate database plugin "rocksdb": IO error: While lock file: /var/osquery/osquery.db/LOCK: Resource temporarily unavailable {"/etc/osquery/osquery.conf": { "option":{ "config_plugin":"filesystem", "logger_plugin":"filesystem", "logger_path":"/var/log/osquery", "log_result_events":"true", "disable_logging":"false", "disable_events":"false", "worker_threads": "2", "utc":"true" }, "schedule":{ "system_info":{ "query":"SELECT * FROM system_info;", "interval": 20 }, "file_events":{ "query":"SELECT * FROM file_events;", "interval":20 } }, "file_paths":{ "home":[ "/home/%%" ] }, "decorators":{ "load": [ "SELECT uuid AS host_uuid FROM system_info;", "SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;" ] }, "packs": { "osquery-monitoring": "/usr/share/osquery/packs/osquery-monitoring.conf" } } }
t

theopolis

09/01/2020, 2:16 AM
Look at the warning above
Failed to activate database plugin "rocksdb": IO error: While lock file: /var/osquery/osquery.db/LOCK: Resource temporarily unavailable
this is indicating another problem. Do you have another
osqueryd
running on this system?
d

demonbhao

09/01/2020, 2:32 AM
Yes, you're really good I looked at the process and found that there really were two Osqueryd living in the system at the same time Do you have any good ways to help me solve the problem of this process This is my osquery.Service File: [Unit] Description=The osquery Daemon After=network.service syslog.service [Service] TimeoutStartSec=0 ExecStart=/usr/bin/osqueryd \ --enroll_secret_path=/var/osquery/enroll_secret \ --tls_server_certs=/var/osquery/server.pem \ --tls_hostname=10.224.100.2:8080 \ --host_identifier=uuid \ --enroll_tls_endpoint=/api/v1/osquery/enroll \ --config_plugin=tls \ --config_tls_endpoint=/api/v1/osquery/config \ --config_refresh=10 \ --disable_distributed=false \ --distributed_plugin=tls \ --distributed_interval=10 \ --distributed_tls_max_attempts=3 \ --distributed_tls_read_endpoint=/api/v1/osquery/distributed/read \ --distributed_tls_write_endpoint=/api/v1/osquery/distributed/write \ --logger_plugin=tls \ --logger_tls_endpoint=/api/v1/osquery/log \ --logger_tls_period=10 [Install] WantedBy=multi-user.target
Hello This problem that there will be two processes to launch osquery service has been bothering me for a long time. Is there any good solution?
👀 1