Hi guys I am having a problem with osquery on macos I believ

Question

Hi guys I am having a problem with osquery on macos I believe it s actually a bug but I just started to work with osquery 2 days ago Where would be a good place to ask Googling does not help What I notice is a lot duplicated events different eid same timestamp It seems to boil down to duplication of subscribers for some tables every time new config with some changes is apllied

Mike Myers · Answer

I think this is the right channel Can you share more info Which platform and which evented tables

Jacek · Answer

starting up osqueryi ```sudo osqueryi disable events=False flagfile= private var osquery osquery flags Password I0722 13 04 26 958304 242097600 init cpp 343 osquery initialized version=4 3 0 I0722 13 04 26 959514 242097600 extensions cpp 383 Could not autoload extensions Failed reading var osquery extensions load I0722 13 04 26 959726 242097600 rocksdb cpp 131 Opening RocksDB handle private var osquery osquery db I0722 13 04 27 010406 242097600 dispatcher cpp 77 Adding new service ExtensionWatcher 0x7ff3bd50cce8 to thread 0x70000edcd000 0x7ff3bd50cc10 in process 32664 I0722 13 04 27 010525 242097600 dispatcher cpp 77 Adding new service ExtensionRunnerCore 0x7ff3bd50a7a8 to thread 0x70000ee50000 0x7ff3bd50ceb0 in process 32664 I0722 13 04 27 010617 242097600 auto constructed tables cpp 96 Removing stale ATC entries I0722 13 04 27 010813 249888768 interface cpp 268 Extension manager service starting Users tyburczyk osquery shell em I0722 13 04 27 011708 242097600 dispatcher cpp 77 Adding new service ConfigRefreshRunner 0x7ff3bd711cf8 to thread 0x70000eed3000 0x7ff3bd711080 in process 32664 I0722 13 04 27 012864 242097600 tls cpp 253 TLS HTTPS POST request to URI <https 127 0 0 1 9000 config> node key b90e07e3 6759 48c0 9ad9 e2ff5293ce30 file paths binaries usr bin usr sbin bin sbin usr local bin usr local sbin opt bin opt sbin configuration etc node invalid false options custom plgx EnableSSL false custom plgx EnableWatcher true disable watchdog true host identifier uuid logger tls compress true schedule splay percent 10 packs schedule test query description id 105 interval 60 platform all query select from socket events where remote port=1234 removed false shard 100 snapshot false tags apt29 test value version I0722 13 04 27 192129 242097600 dispatcher cpp 77 Adding new service TLSLogForwarder 0x7ff3bd60c0c8 to thread 0x70000efd9000 0x7ff3bd611d10 in process 32664 I0722 13 04 27 192270 242097600 system cpp 294 Using host identifier C7B4C7ED 0DF6 569F 9E7A 10DEC3827CB5 I0722 13 04 27 194416 242097600 events cpp 863 Event publisher not enabled scnetwork Publisher not used I0722 13 04 27 194458 242097600 events cpp 863 Event publisher not enabled event tapping Publisher disabled via configuration I0722 13 04 27 230384 242097600 file events cpp 67 Added file event listener to usr bin I0722 13 04 27 230437 242097600 file events cpp 67 Added file event listener to usr sbin I0722 13 04 27 230453 242097600 file events cpp 67 Added file event listener to bin I0722 13 04 27 230466 242097600 file events cpp 67 Added file event listener to sbin I0722 13 04 27 230479 242097600 file events cpp 67 Added file event listener to usr local bin I0722 13 04 27 230490 242097600 file events cpp 67 Added file event listener to usr local sbin I0722 13 04 27 230502 242097600 file events cpp 67 Added file event listener to opt bin I0722 13 04 27 230513 242097600 file events cpp 67 Added file event listener to opt sbin I0722 13 04 27 230526 242097600 file events cpp 67 Added file event listener to private etc Using a virtual database Need help type help I0722 13 04 27 230753 252035072 events cpp 784 Starting event publisher run loop diskarbitration I0722 13 04 27 230782 253108224 events cpp 784 Starting event publisher run loop iokit I0722 13 04 27 230784 252571648 events cpp 784 Starting event publisher run loop fsevents I0722 13 04 27 230792 253644800 events cpp 784 Starting event publisher run loop openbsm```

Jacek · Answer

configuration ```osquery gt show osquery being built with love at Facebook ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ osquery 4 3 0 using SQLite 3 31 1 General settings Flagfile private var osquery osquery flags Config tls 127 0 0 1 9000 config Logger filesystem tls Distributed tls Database rocksdb private var osquery osquery db Extensions core Socket Users tyburczyk osquery shell em Shell settings echo off headers on mode pretty nullvalue output stdout separator | width Non default flags options I0722 13 04 29 993309 242097600 sqlite util cpp 267 DBManager contention opening transient SQLite database I0722 13 04 30 020293 242097600 sqlite util cpp 267 DBManager contention opening transient SQLite database allow unsafe true audit allow sockets true carver block size 300000 carver continue endpoint upload blocks carver disable function false carver start endpoint start uploads config plugin tls config refresh 300 config tls endpoint config config tls max attempts 5 custom plgx EnableSSL false custom plgx EnableWatcher true database path private var osquery osquery db disable audit false disable carver false disable distributed false disable watchdog true distributed interval 15 distributed tls max attempts 5 distributed tls read endpoint distributed read distributed tls write endpoint distributed write enroll secret path private var osquery secret txt enroll tls endpoint enroll events max 2500 extensions socket Users tyburczyk osquery shell em hash delay 0 host identifier uuid logger path private var log logger plugin filesystem tls logger tls compress true logger tls endpoint log logger tls period 30 pack delimiter pidfile private var osquery osquery pid stderrthreshold 3 tls dump true tls hostname 127 0 0 1 9000 tls server certs private var osquery certificate crt verbose true watchdog level 1```

Jacek · Answer

and publisher subscriber after loading initial config ```osquery gt select from osquery events + + + + + + + + | name | publisher | type | subscriptions | events | refreshes | active | + + + + + + + + | diskarbitration | diskarbitration | publisher | 1 | 9 | 0 | 1 | | event tapping | event tapping | publisher | 1 | 0 | 0 | 0 | | fsevents | fsevents | publisher | 9 | 0 | 0 | 1 | | iokit | iokit | publisher | 1 | 0 | 0 | 1 | | openbsm | openbsm | publisher | 11 | 1082 | 0 | 1 | | scnetwork | scnetwork | publisher | 0 | 0 | 0 | 0 | | disk events | diskarbitration | subscriber | 1 | 9 | 0 | 1 | | file events | fsevents | subscriber | 9 | 0 | 0 | 1 | | hardware events | iokit | subscriber | 1 | 0 | 0 | 1 | | process events | openbsm | subscriber | 8 | 0 | 0 | 1 | | socket events | openbsm | subscriber | 2 | 4 | 0 | 1 | | user events | openbsm | subscriber | 1 | 0 | 0 | 1 | | user interaction events | event tapping | subscriber | 1 | 0 | 0 | 1 | | yara events | fsevents | subscriber | 0 | 0 | 0 | 1 | + + + + + + + +```

Jacek · Answer

now I did changes to scheduled queries at the server so the next time config comes as ```osquery gt I0722 13 09 27 013913 250425344 config cpp 1214 Refreshing configuration state I0722 13 09 27 015131 250425344 tls cpp 253 TLS HTTPS POST request to URI <https 127 0 0 1 9000 config> node key b90e07e3 6759 48c0 9ad9 e2ff5293ce30 file paths binaries usr bin usr sbin bin sbin usr local bin usr local sbin opt bin opt sbin configuration etc node invalid false options custom plgx EnableSSL false custom plgx EnableWatcher true disable watchdog true host identifier uuid logger tls compress true schedule splay percent 10 packs schedule test query description id 105 interval 60 platform all query select from socket events where remote port=1235 removed false shard 100 snapshot false tags apt29 test value version I0722 13 09 27 162900 250425344 file events cpp 67 Added file event listener to usr bin I0722 13 09 27 162940 250425344 file events cpp 67 Added file event listener to usr sbin I0722 13 09 27 162955 250425344 file events cpp 67 Added file event listener to bin I0722 13 09 27 162968 250425344 file events cpp 67 Added file event listener to sbin I0722 13 09 27 162981 250425344 file events cpp 67 Added file event listener to usr local bin I0722 13 09 27 162992 250425344 file events cpp 67 Added file event listener to usr local sbin I0722 13 09 27 163004 250425344 file events cpp 67 Added file event listener to opt bin I0722 13 09 27 163015 250425344 file events cpp 67 Added file event listener to opt sbin I0722 13 09 27 163028 250425344 file events cpp 67 Added file event listener to private etc I0722 13 09 27 164523 250425344 config cpp 899 Calling configure for logger filesystem I0722 13 09 27 164557 250425344 config cpp 899 Calling configure for logger tls``` just a change of port in scheduled query

Jacek · Answer

after this you can see subscribers added again without removing of previous subscriptions this is a bit of the guess based on numbers ```osquery gt select from osquery events + + + + + + + + | name | publisher | type | subscriptions | events | refreshes | active | + + + + + + + + | diskarbitration | diskarbitration | publisher | 1 | 9 | 0 | 1 | | event tapping | event tapping | publisher | 2 | 0 | 0 | 0 | | fsevents | fsevents | publisher | 9 | 0 | 1 | 1 | | iokit | iokit | publisher | 1 | 0 | 0 | 1 | | openbsm | openbsm | publisher | 22 | 296389 | 0 | 1 | | scnetwork | scnetwork | publisher | 0 | 0 | 0 | 0 | | disk events | diskarbitration | subscriber | 1 | 9 | 0 | 1 | | file events | fsevents | subscriber | 9 | 0 | 0 | 1 | | hardware events | iokit | subscriber | 1 | 0 | 0 | 1 | | process events | openbsm | subscriber | 16 | 3 | 0 | 1 | | socket events | openbsm | subscriber | 4 | 100 | 0 | 1 | | user events | openbsm | subscriber | 2 | 0 | 0 | 1 | | user interaction events | event tapping | subscriber | 2 | 0 | 0 | 1 | | yara events | fsevents | subscriber | 0 | 0 | 0 | 1 | + + + + + + + +```

Jacek · Answer

so for the following number has doubled event taping openbsm process events socket events user events user interaction events for following cannot tell scnetwork yara events

Jacek · Answer

I believe this is why I am observing duplicated events later on After issuing one `curl <http portquiz net 1234|portquiz net 1234>` I get 2 events with different eids but the same timestamp ```osquery gt select eid from socket events where remote port=1234 + + + + + + + + + + + + + + + | action | pid | path | fd | auid | success | family | local address | remote address | local port | remote port | time | uptime | eid | + + + + + + + + + + + + + + + | connect | 33004 | usr bin curl | 5 | 501 | 0 | 2 | 0 | 52 47 209 216 | 0 | 1234 | 1595416715 | 429288 | 0000001391 | | connect | 33004 | usr bin curl | 5 | 501 | 0 | 2 | 0 | 52 47 209 216 | 0 | 1234 | 1595416715 | 429288 | 0000001392 | + + + + + + + + + + + + + + + ```

Jacek · Answer

We were not able to reproduce this behaviour on linux only macOS

Jacek · Answer

Shell I provide additional details

Jacek · Answer

Also probably important After restarting all numbers are back to original values

Mike Myers · Answer

Thanks Jacek These are good details but since I don t know the solution maybe I ll refer it to the channel outside this thread to reply otherwise we may have to open an issue on Github about it