I think there s a bug with using an extension s table as a d

Question

I think there s a bug with using an extension s table as a discovery query for a pack Details in thread

HarlanF · Answer

It s a python extension and here s the lines from `sudo osqueryi verbose` that reference it

HarlanF · Answer

```I1101 01 06 38 005260 15364 watcher cpp 732 Created and monitoring extension child 15369 usr lib osquery bookings meminfo ext W1101 01 06 38 069183 15363 packs cpp 326 Discovery query failed select valueKB from bookings meminfo where key= Hugepagesize no such table bookings meminfo I1101 01 06 38 081598 15374 interface cpp 137 Registering extension meminfo 18355 version=1 0 0 sdk=1 8 0 I1101 01 06 38 082294 15374 registry factory cpp 107 Extension 18355 registered table plugin bookings meminfo```

HarlanF · Answer

This one s kind of a nonsense discovery query but we have a more complex one that s actually causing trouble

HarlanF · Answer

I get no such problem when I use one of the core tables in this manner

HarlanF · Answer

Also once the prompt comes up for me I can easily do a ```select from bookings meminfo ``` and results work fine

HarlanF · Answer

Ideas

seph · Answer

Hrm I wonder if the discovery query is triggering before the table is loaded IIRC those might run and get cached Does it change if you use the osquery flag ` extensions require` so osquery waits for this extension

HarlanF · Answer

< seph> I think I tried that before but will test it today and let you know

HarlanF · Answer

Oh and that s definitely my read on things from the verbose events order above

HarlanF · Answer

< seph> Hmm confusing I m assuming that it wants the extension s filename without path or the ` ext` at the end That works for one of the extensions to launch osqueryi with that ` extensions require` parameter But if I change the discovery query to another custom extension we have 5 presently and attempt require the other one or both comma delimited it doesn t work

seph · Answer

I would expect extensions require to be looking for the name the extension registers itself with Which is unrelated to the file name

HarlanF · Answer

Hmm seems experimentally like that s not the case Most of ours line up 1 to 1 but not one of them That one is the unique one that seems to work at suppressing the error

HarlanF · Answer

Oof I need to go read the documentation and see what s intended for each These things don t seem like they line up ```bookings meminfo ext 14 return bookings meminfo 59 osquery start extension name= meminfo version= 1 0 0 sysconfig bookings ext 19 return bookings puppet 91 osquery start extension name= sysconfig bookings version= 1 0 2 bookings scsi devices ext 14 return bookings scsi devices 71 osquery start extension name= scsi info version= 1 0 0 bookings last ext 18 return bookings last 62 osquery start extension name= bookings last version= 1 0 1 bookings lsblk ext 14 return bookings lsblk 47 osquery start extension name= bookings lsblk version= 1 0 0 ```

HarlanF · Answer

Yeah that may be my root cause Will get those all ship shape and see if this problem goes away

HarlanF · Answer

Thanks

HarlanF · Answer

< seph> are there any interdependencies between file name table name and extension name the one referenced by start extension

seph · Answer

Nope I haven t read the code so it s a bit shrug but I m not aware of anything I will say that Kolide s Launcher is pretty weird it manages itself and registers 2 extensions with names that have nothing to do with the file name And osquery doesn t know the file name anyhow So I think you have a lot of flexibility

HarlanF · Answer

Thanks so much I think in covering that factoid we ve stumbled across a solid lead in trying to reduce some errors in our setup slightly smiling face

seph · Answer

Happy to help

seph · Answer

one other thing to note is that it s a bit of a toss up whether having 1 extension or many is better Combining into a single extension means fewer processes running for example

HarlanF · Answer

Oh that s an interesting idea We ve got 5 because they re going after completely different things Is your thought process that we could just mash the results together into a virtual table

seph · Answer

No Just register 5 tables in one extension

HarlanF · Answer

Oh hmm Have to think about that especially regarding if one of them dies somehow would the watchdog restart the whole set of them

seph · Answer

I have no idea how the watchdog and extensions intersect

HarlanF · Answer

Well that s a cool idea I ll backlog a ticket to play with that

seph · Answer

Somewhat there s a question here aboiut what s easiest to manage From lots of perspectives software dev extension distribution runtime stability runtime performance Probably no really simple answer Though at least a few years ago we all biased towards single extension multiple things inside it

seph · Answer

The SDKs are based around it

HarlanF · Answer

Oh wow I ve been oblivious to that

seph · Answer

Always something new to learn slightly smiling face

HarlanF · Answer

that s standing in for amen

HarlanF · Answer

Any examples of 2+ TablePlugin within one file I m looking at the example with one in it and my assumptions are 1 gather all the unique `import` lines to the top 2 have an ` osquery register plugin` macro at the top of each class definition 3 have a start extension call for each of them down in the `name == main` section

seph · Answer

Sounds like python I don t really use python but I suspect it s calling `REGISTER EXTERNAL` several times

seph · Answer

Oh which is probably ` osquery register plugin` in your comment

seph · Answer

I d expect onle a single `start extension `

seph · Answer

Basically you create an extension Then you register plugins to the extension Then you start the extension

HarlanF · Answer

Oh yup Oh Here I was thinking that the name was the table name but you re right Probably just the one Not ```osquery start extension name= bookings puppet version= 1 0 3 osquery start extension name= bookings last version= 1 0 1 osquery start extension name= bookings lsblk version= 1 0 0 osquery start extension name= bookings meminfo version= 1 0 1 ```

HarlanF · Answer

Thus the extension name is distinct from the table names

seph · Answer

Yeah not that slightly smiling face

HarlanF · Answer

Okay thanks Helped to have a fresh set of eyes

seph · Answer

name is the extension name version is the extension version

seph · Answer

You can poke around some of the osquery tables that expose this `osquery extensions` and `osquery registry`

HarlanF · Answer

Okay will do I strongly suspect we re going to get rid of a couple classes of errors by doing this crossed fingers