Hi everyone I m currently trying to use the events tables ru osquery #general

Hi everyone ! I’m currently trying to use the even...

gby

08/08/2018, 10:24 AM

Hi everyone ! I’m currently trying to use the events tables, running osqueryd in the background, and querying periodically the tables with osqueryi --database_path, but I get

Copy code

Failed to upgrade database

Has anyone tried this before ? I’ve seen this issue on github https://github.com/facebook/osquery/issues/4615 The script does fix the problem, but the osqueryd service has to be stopped and restarted to migrate and fixe the issue

fmanco

08/08/2018, 10:59 AM

Having multiple processes operating on the same DB at the same time is not supported. osquery 3.3.0 already includes the migration that script is doing, so you don't need to run it anymore.

👍 2

gby

08/08/2018, 12:10 PM

alright ! so moving to 3.3.0 should fix that ?

gby

08/08/2018, 12:35 PM

I wished multiple connections to the RocksDB were supported, to have a reversed chain of command between the central server and the hosts (querying the systems and getting the data when you want, instead of defining a periodic schedule and getting posts to the server)

thor

08/08/2018, 4:19 PM

Just for posterity, looks like the "Database failed to upgrade" message is showing up whenever mutliple processes are attempting to connect to a DB that osqueryd already has open. This isn't a huge deal, as @fmanco mentioned this isn't supported behavior, however we should likely alter the user experience here so it's not confusing as to why it's failing

👍 1

fmanco

08/08/2018, 4:30 PM

Yeah we should definitely handle that.

5 Views

Open in Slack

Previous Next