https://github.com/osquery/osquery logo
Title
m

Mystery Incorporated

08/20/2021, 11:25 AM
It doesn't seem to download the vulnerability database either
t

Tomas Touceda

08/20/2021, 11:28 AM
is the databases path writable by the fleet process? and do you have any logs for this?
m

Mystery Incorporated

08/20/2021, 11:29 AM
@Tomas Touceda it sure is, it's a folder that's specifically owned by the logstash user which is also running fleet
It has something in there now
t

Tomas Touceda

08/20/2021, 11:31 AM
ok, that's great! so it did download
m

Mystery Incorporated

08/20/2021, 11:31 AM
@Tomas Touceda oh I see, 128MB is not enough space
t

Tomas Touceda

08/20/2021, 11:33 AM
correct, it takes ~300mb, I should document that
m

Mystery Incorporated

08/20/2021, 11:34 AM
Gotcha, I created a 128MB RAM disk for it thinking I could be clever and offload some IO from the SSD
Might need a try{}catch{throw out_of_storage} in there or whatever is done in Go
t

Tomas Touceda

08/20/2021, 11:39 AM
I would've expected it to fail to write the file and log it, weird
oh I know what I missed, will address it soon
👍 1