Title
#general
z

Zach Zeid

04/02/2020, 6:19 PM
I'm seeing osqueryd segfaulting on some of our instances, what can I check here to see why?
l

Lawrence D'Anna

04/02/2020, 6:22 PM
on mac os you could look for
/Library/Logs/DiagnosticReports/*osquery*.crash
z

Zach Zeid

04/02/2020, 6:23 PM
this is on rhel itself
a

alessandrogario

04/02/2020, 6:46 PM
I’ve seen a bug report about the
magic
table, is there any chance it is being used in your query packs? EDIT: fixed the table name
6:49 PM
I think we had support for debug symbol packages on *.rpm (cc @Stefano Bonicatti)
z

Zach Zeid

04/02/2020, 6:53 PM
no, we're just getting a list of packages and processes
6:54 PM
no
magic
table that I know of.
Stefano Bonicatti

Stefano Bonicatti

04/02/2020, 6:59 PM
There should be a
osquery-debuginfo
package to be installed so that symbols are available when looking at stack traces
z

Zach Zeid

04/02/2020, 7:00 PM
how do I use that?
7:01 PM
just run it?
Stefano Bonicatti

Stefano Bonicatti

04/02/2020, 7:04 PM
That package exists only to install the debug symbols; to get a stack trace you either have to run osquery under a debugger (gdb), or have core dumps enabled and point gdb to it.
z

Zach Zeid

04/02/2020, 7:38 PM
it's not clear how to enable core dumps for osquery
Stefano Bonicatti

Stefano Bonicatti

04/03/2020, 10:23 AM
You might want to look at https://access.redhat.com/solutions/56021. There’s no specific way for osquery, it’s a system feature to enable system wide or temporarily in a shell where you would then launch osquery. The procedure differs slightly from distro to distro and versions; that link should help.