Hi Fleet peeps! I spotted after upgrading to Fleet...
# fleet
Hi Fleet peeps! I spotted after upgrading to Fleet 4.22.1 that our custom osquery extension (which provides a new virtual table called
) stopped working, in queries where we try to use it, we get an error
vtable constructor failed: de_metadata
Is there a known issue with custom extensions for osquery? We’re using osquery 5.3.0.
message has been deleted
Hey @Ryan! The osquery logs on your hosts might have some helpful information here about why that extension isn't loading properly. Here's a debugging guide for osquery that should be helpful: https://fleetdm.com/docs/deploying/debugging#osquery
This seems unlikely to be related to the Fleet update... Nothing has changed recently about how a live query would be sent to osquery. Has anything changed about your osquery version, your extension, or how you deploy them recently?
Hi, yeah I wasn’t sure if it could be, but then I wondered if it was trying to look up metadata about the virtual table but not finding it since the table isn’t part of the normal osquery schema
Notably, it works if I run
locally on one of the hosts, the extension loads and I can query the contents of our new table.
Ok so further debugging - I don’t see any errors logged, but during a test on one of the hosts I restarted osqueryd and the custom table is working again now 🤔
very unusual, but seems like an osquery issue and nothing to do with Fleet at all, so sorry for the false alarm!