https://github.com/osquery/osquery logo
Title
z

Zweasta

07/06/2020, 9:04 PM
What does it mean when osqueryi command has a return code = 78 ?
t

theopolis

07/06/2020, 9:50 PM
The intention of 78 is some pretty bad unrecoverable error
Do you have more details you can share?
z

Zweasta

07/06/2020, 11:55 PM
I installed osquery on one of my centos vms. All the other vms are working fine except for one. No idea why its happening on only one centos vm.
It gives the output, then freezes for 1 or 2 seconds, and then exits, but when I check the return code it is 78.
t

theopolis

07/07/2020, 12:08 AM
Is it repeatable on that host? Can you run with —verbose ( two dashes )
z

Zweasta

07/07/2020, 1:20 AM
I0707 01:19:08.853183 160859 init.cpp:343] osquery initialized [version=4.3.0]
I0707 01:19:08.853262 160859 extensions.cpp:383] Could not autoload extensions: Failed reading: /etc/osquery/extensions.load
I0707 01:19:08.853324 160859 init.cpp:567] An error occured during extension manager startup: Extensions disabled
I0707 01:19:08.853341 160859 auto_constructed_tables.cpp:96] Removing stale ATC entries
These are the logs if I used --verbose
Yes, it is repeatable and seen every single time.