Hey all upgraded to ventura on macOS and get the following a

Question

Hey all upgraded to ventura on macOS and get the following anyone run into this ```sudo opt osquery lib osquery app Contents MacOS osqueryd config path= var osquery osquery conf disable events=false disable endpointsecurity=false enable file events=true Password E1027 14 51 56 195858 267033344 shutdown cpp 79 Cannot activate filesystem logger plugin Could not create file var log osquery osqueryd results log E1027 14 51 59 188417 1806135296 shutdown cpp 79 Worker returned exit status```

sharvil · Answer

hrm haven t seen that one before does `config path= var osquery osquery conf` exist and valid I would throw in a ` verbose` and see if it sheds more light

Brandon Mesa · Answer

Yep it exists and has been validated ```bmesa Brandons MacBook Pro 2 15 01 31 ~ gt sudo osqueryctl config check bmesa Brandons MacBook Pro 2 15 01 38 ~ gt sudo opt osquery lib osquery app Contents MacOS osqueryd config path= var osquery osquery conf disable events=false disable endpointsecurity=false enable file events=true verbose I1027 15 01 48 281931 267033344 init cpp 399 osquery initialized version=5 5 1 I1027 15 01 48 283535 267033344 extensions cpp 453 Could not autoload extensions Cannot open file for reading var osquery extensions load I1027 15 01 48 283571 267033344 dispatcher cpp 78 Adding new service WatcherRunner 0x600002f80018 to thread 0x16b68b000 0x60000128c000 in process 13192 I1027 15 01 48 284088 1802022912 watcher cpp 680 osqueryd watcher 13192 executing worker 13193 I1027 15 01 48 295619 267033344 init cpp 396 osquery worker initialized watcher=13192 I1027 15 01 48 296422 267033344 dispatcher cpp 78 Adding new service WatcherWatcherRunner 0x600001180018 to thread 0x16efb7000 0x60000288c000 in process 13193 I1027 15 01 48 296506 267033344 rocksdb cpp 132 Opening RocksDB handle var osquery osquery db I1027 15 01 48 303813 267033344 dispatcher cpp 78 Adding new service ExtensionWatcher 0x14e60a0e8 to thread 0x16f38b000 0x6000028822f0 in process 13193 I1027 15 01 48 303853 267033344 dispatcher cpp 78 Adding new service ExtensionRunnerCore 0x14e60c248 to thread 0x16f417000 0x600002882200 in process 13193 I1027 15 01 48 303874 1866559488 interface cpp 299 Extension manager service starting var osquery osquery em I1027 15 01 48 303881 267033344 auto constructed tables cpp 99 Removing stale ATC entries E1027 15 01 48 304786 267033344 shutdown cpp 79 Cannot activate filesystem logger plugin Could not create file var log osquery osqueryd results log I1027 15 01 48 305431 267033344 dispatcher cpp 149 Thread 0x1f0156500 requesting a stop I1027 15 01 48 305455 267033344 dispatcher cpp 156 Service 0x600001180018 has been interrupted I1027 15 01 48 305471 267033344 dispatcher cpp 156 Service 0x14e60a0e8 has been interrupted I1027 15 01 48 305495 267033344 dispatcher cpp 156 Service 0x14e60c248 has been interrupted I1027 15 01 48 305511 267033344 dispatcher cpp 122 Thread 0x1f0156500 requesting a join I1027 15 01 48 305672 267033344 dispatcher cpp 140 Service thread 0x600002882200 has joined I1027 15 01 48 305696 267033344 dispatcher cpp 140 Service thread 0x6000028822f0 has joined I1027 15 01 48 305713 267033344 dispatcher cpp 140 Service thread 0x60000288c000 has joined I1027 15 01 48 305728 267033344 dispatcher cpp 144 Services and threads have been cleared E1027 15 01 51 289422 1802022912 shutdown cpp 79 Worker returned exit status I1027 15 01 51 289984 267033344 dispatcher cpp 149 Thread 0x1f0156500 requesting a stop I1027 15 01 51 290017 267033344 dispatcher cpp 122 Thread 0x1f0156500 requesting a join I1027 15 01 51 290046 267033344 dispatcher cpp 140 Service thread 0x60000128c000 has joined I1027 15 01 51 290064 267033344 dispatcher cpp 144 Services and threads have been cleared```

Brandon Mesa · Answer

i created the var log osquery directory and now the daemon is initializing

Brandon Mesa · Answer

not sure why it didn t have sufficient privileges if i ran it as root

sharvil · Answer

that is weird I wonder if some stale fd lingered on or whether ventura changed something

sharvil · Answer

fwiw I haven t seen this on my test ventura VMs

Brandon Mesa · Answer

right wonder if a clean install would not run into such behavior

Brandon Mesa · Answer

did you do a clean install on your ventura VMs

sharvil · Answer

one of them is a 12 6 to 13 beta upgrade the other is a clean one

Brandon Mesa · Answer

mmm okay

sharvil · Answer

I will keep an eye out and try it when I get some more time but feel free to open an issue as well if you are seeing it again or on more machines

Stefano Bonicatti · Answer

I think the osquery binary expects for that folder to already exists I don t see logic to create that but it s installed by the package <https github com osquery osquery packaging blob 4caa2c54f0d893c1efa47932571046bbce156c52 platform macos common cmake L55 L58>

Brandon Mesa · Answer

Ah great catch < Stefano Bonicatti> I noticed the directory was deleted after upgrading

Stefano Bonicatti · Answer

Might make sense to remove this behavior and let osquery create the folder