https://github.com/osquery/osquery logo
Title
z

Zach Zeid

04/02/2020, 6:19 PM
I'm seeing osqueryd segfaulting on some of our instances, what can I check here to see why?
l

Lawrence D'Anna

04/02/2020, 6:22 PM
on mac os you could look for
/Library/Logs/DiagnosticReports/*osquery*.crash
z

Zach Zeid

04/02/2020, 6:23 PM
this is on rhel itself
a

alessandrogario

04/02/2020, 6:46 PM
I’ve seen a bug report about the
magic
table, is there any chance it is being used in your query packs? EDIT: fixed the table name
I think we had support for debug symbol packages on *.rpm (cc @Stefano Bonicatti)
z

Zach Zeid

04/02/2020, 6:53 PM
no, we're just getting a list of packages and processes
no
magic
table that I know of.
s

Stefano Bonicatti

04/02/2020, 6:59 PM
There should be a
osquery-debuginfo
package to be installed so that symbols are available when looking at stack traces
z

Zach Zeid

04/02/2020, 7:00 PM
how do I use that?
just run it?
s

Stefano Bonicatti

04/02/2020, 7:04 PM
That package exists only to install the debug symbols; to get a stack trace you either have to run osquery under a debugger (gdb), or have core dumps enabled and point gdb to it.
z

Zach Zeid

04/02/2020, 7:38 PM
it's not clear how to enable core dumps for osquery
s

Stefano Bonicatti

04/03/2020, 10:23 AM
You might want to look at https://access.redhat.com/solutions/56021. There’s no specific way for osquery, it’s a system feature to enable system wide or temporarily in a shell where you would then launch osquery. The procedure differs slightly from distro to distro and versions; that link should help.