HarlanF
11/01/2022, 12:11 AMsudo osqueryi --verbose
that reference it:I1101 01:06:38.005260 15364 watcher.cpp:732] Created and monitoring extension child (15369): /usr/lib/osquery/bookings_meminfo.ext
W1101 01:06:38.069183 15363 packs.cpp:326] Discovery query failed (select valueKB from bookings_meminfo where key='Hugepagesize';): no such table: bookings_meminfo
I1101 01:06:38.081598 15374 interface.cpp:137] Registering extension (meminfo, 18355, version=1.0.0, sdk=1.8.0)
I1101 01:06:38.082294 15374 registry_factory.cpp:107] Extension 18355 registered table plugin bookings_meminfo
select * from bookings_meminfo;
and results work fine.seph
11/01/2022, 12:27 AM--extensions_require
so osquery waits for this extension?HarlanF
11/01/2022, 2:47 PM.ext
at the end). That works for one of the extensions, to launch osqueryi with that --extensions_require
parameter. But if I change the discovery query to another custom extension (we have 5 presently), and attempt require the other one (or both, comma-delimited) it doesn't work.seph
11/01/2022, 8:26 PMHarlanF
11/01/2022, 8:27 PMbookings_meminfo.ext
14: return "bookings_meminfo"
59: osquery.start_extension(name="meminfo", version="1.0.0")
sysconfig_bookings.ext
19: return "bookings_puppet"
91: osquery.start_extension(name="sysconfig_bookings", version="1.0.2")
bookings_scsi_devices.ext
14: return "bookings_scsi_devices"
71: osquery.start_extension(name="scsi_info", version="1.0.0")
bookings_last.ext
18: return "bookings_last"
62: osquery.start_extension(name="bookings_last", version="1.0.1")
bookings_lsblk.ext
14: return "bookings_lsblk"
47: osquery.start_extension(name="bookings_lsblk", version="1.0.0")
seph
11/01/2022, 8:56 PMHarlanF
11/01/2022, 8:57 PMseph
11/01/2022, 8:57 PMHarlanF
11/01/2022, 9:00 PMseph
11/01/2022, 9:00 PMHarlanF
11/01/2022, 9:02 PMseph
11/01/2022, 9:02 PMHarlanF
11/01/2022, 9:03 PMseph
11/01/2022, 9:04 PMHarlanF
11/01/2022, 9:05 PMseph
11/01/2022, 9:05 PMHarlanF
11/01/2022, 9:06 PMimport
lines to the top
2. have an @osquery.register_plugin
macro at the top of each class definition
3. have a start_extension() call for each of them down in the name == main
sectionseph
11/02/2022, 5:31 PMREGISTER_EXTERNAL
several times.@osquery.register_plugin
in your comment.start_extension()
HarlanF
11/02/2022, 5:32 PMosquery.start_extension(name="bookings_puppet", version="1.0.3")
osquery.start_extension(name="bookings_last", version="1.0.1")
osquery.start_extension(name="bookings_lsblk", version="1.0.0")
osquery.start_extension(name="bookings_meminfo", version="1.0.1")
[...]
seph
11/02/2022, 5:32 PMHarlanF
11/02/2022, 5:32 PMseph
11/02/2022, 5:32 PMosquery_extensions
and osquery_registry
HarlanF
11/02/2022, 5:35 PM