What does it mean when osqueryi command has a retu...
# generalz
Zweasta
07/06/2020, 9:04 PMWhat does it mean when osqueryi command has a return code = 78 ?
t
theopolis
07/06/2020, 9:50 PM
The intention of 78 is some pretty bad unrecoverable error
theopolis
07/06/2020, 9:51 PM
Do you have more details you can share?
z
Zweasta
07/06/2020, 11:55 PMI installed osquery on one of my centos vms. All the other vms are working fine except for one. No idea why its happening on only one centos vm.
Zweasta
07/06/2020, 11:55 PMIt gives the output, then freezes for 1 or 2 seconds, and then exits, but when I check the return code it is 78.
t
theopolis
07/07/2020, 12:08 AM
Is it repeatable on that host? Can you run with —verbose ( two dashes )
z
Zweasta
07/07/2020, 1:20 AMI0707 01:19:08.853183 160859 init.cpp:343] osquery initialized [version=4.3.0]I0707 01:19:08.853262 160859 extensions.cpp:383] Could not autoload extensions: Failed reading: /etc/osquery/extensions.loadI0707 01:19:08.853324 160859 init.cpp:567] An error occured during extension manager startup: Extensions disabledI0707 01:19:08.853341 160859 auto_constructed_tables.cpp:96] Removing stale ATC entriesZweasta
07/07/2020, 1:20 AMThese are the logs if I used --verbose
Zweasta
07/07/2020, 1:51 PMYes, it is repeatable and seen every single time.
6 Views