Also tried ubuntu with the same error. Thanks
# extensionsh
hubert dulay
06/10/2022, 12:43 PMAlso tried ubuntu with the same error. Thanks
a
alessandrogario
06/10/2022, 1:32 PM
This seems like a problem with the extension itself
alessandrogario
06/10/2022, 1:32 PM
see if it can be started directly with the same path
s
seph
06/10/2022, 1:55 PM
Yeah… Sounds like the extension is exiting, and osquery respawns it.
Try running it manually.
h
hubert dulay
06/10/2022, 2:29 PMno errors when i run manually.
hubert dulay
06/10/2022, 2:30 PMI was able to get this ext to work. https://github.com/osquery/osquery-python/blob/master/examples/many_plugins.ext
hubert dulay
06/10/2022, 2:30 PMi think it might be a permissions issue with installing mods with pip
hubert dulay
06/10/2022, 2:39 PMfound the error. i had to:
chmod +x pulsar.exts
seph
06/10/2022, 2:39 PM
That makes sense — so how were you running it manually that it worked?
h
hubert dulay
06/10/2022, 2:40 PMi called with python
hubert dulay
06/10/2022, 2:40 PMpython pulsar.exts
seph
06/10/2022, 2:40 PM
Yeah…. That is fairly different.
h
hubert dulay
06/10/2022, 2:41 PMi also need to
ln -s python3 pythons
seph
06/10/2022, 2:41 PM
I don’t think osquery looks for python.
pulsar.exth
hubert dulay
06/10/2022, 2:42 PMah, makes sense now thanks all
a
alessandrogario
06/10/2022, 2:44 PM
Yeah I think you could replace it with
#!/usr/bin/env python3☝️ 2
h
hubert dulay
06/18/2022, 1:15 AMThanks for the help! https://www.decodable.co/blog/routing-osquery-events-via-apache-pulsar
s
seph
06/18/2022, 1:16 AM
FWIW
OSQueryosqueryOsquery👍 1
seph
06/18/2022, 1:18 AM
No comments about the code, but I ❤️ seeing osquery blog posts. Y’all do awesome things
❤️ 1
16 Views