I'm seeing osqueryd segfaulting on some of our instances, what can I check here to see why?
04/02/2020, 6:22 PM
on mac os you could look for
04/02/2020, 6:23 PM
this is on rhel itself
04/02/2020, 6:46 PM
I’ve seen a bug report about the
table, is there any chance it is being used in your query packs?EDIT: fixed the table name
I think we had support for debug symbol packages on *.rpm (cc @Stefano Bonicatti)
04/02/2020, 6:53 PM
no, we're just getting a list of packages and processes
table that I know of.
04/02/2020, 6:59 PM
There should be a
package to be installed so that symbols are available when looking at stack traces
04/02/2020, 7:00 PM
how do I use that?
just run it?
04/02/2020, 7:04 PM
That package exists only to install the debug symbols; to get a stack trace you either have to run osquery under a debugger (gdb), or have core dumps enabled and point gdb to it.
04/02/2020, 7:38 PM
it's not clear how to enable core dumps for osquery
04/03/2020, 10:23 AM
You might want to look at https://access.redhat.com/solutions/56021. There’s no specific way for osquery, it’s a system feature to enable system wide or temporarily in a shell where you would then launch osquery. The procedure differs slightly from distro to distro and versions; that link should help.