https://github.com/osquery/osquery logo
Title
a

alessandrogario

10/23/2018, 12:59 PM
they are either non-blocking sockets or connections that have failed
e

evilrez

10/24/2018, 7:25 PM
hi @alessandrogario, could you provide any link/reference where I find any information about status=no for non-blocking sockets?
a

alessandrogario

10/25/2018, 11:12 AM
Status? I think you are referring to "success"? I don't think there's much documentation about that matter; everything that returns with
exit=
!= 0 is emitted with
success=no
And if you look at the documentation for some syscalls like
connect
(man 3 connect) you can see the following:
RETURN VALUE
       Upon successful completion, connect() shall return 0; otherwise, −1 shall be returned and errno set to indicate the error.
EINPROGRESS
              O_NONBLOCK is set for the file descriptor for the socket and the connection cannot be immediately established; the connection shall be established asynchronously.
e

evilrez

10/25/2018, 3:35 PM
Yea, I mean success, not status. It makes sense. Thank you so much for clarification!