https://github.com/osquery/osquery logo
Title
a

Aleksandr Maus

07/06/2022, 2:47 PM
Hi, Been playing with curl table, specifically needed to be able to emulate the long running queries with predictable timeout. Noticed that the timeout looks hardcoded to 16 secs atm
osquery> select * from curl where url='<https://httpstat.us/200?sleep=15500>';
+-------------------------------------+--------+------------+---------------+-----------------+-------+--------+
| url                                 | method | user_agent | response_code | round_trip_time | bytes | result |
+-------------------------------------+--------+------------+---------------+-----------------+-------+--------+
| <https://httpstat.us/200?sleep=15500> | GET    | osquery    | 200           | 15703207        | 6     | 200 OK |
+-------------------------------------+--------+------------+---------------+-----------------+-------+--------+
osquery> select * from curl where url='<https://httpstat.us/200?sleep=16000>';
W0706 10:45:20.738400 191976960 curl.cpp:83] Error making request: Operation timed out
+-------------------------------------+--------+------------+---------------+-----------------+-------+--------+
| url                                 | method | user_agent | response_code | round_trip_time | bytes | result |
+-------------------------------------+--------+------------+---------------+-----------------+-------+--------+
| <https://httpstat.us/200?sleep=16000> | GET    | osquery    |               |                 |       |        |
+-------------------------------------+--------+------------+---------------+-----------------+-------+--------+
Think this it the place where it is hardcoded: https://github.com/osquery/osquery/blob/master/osquery/remote/transports/tls.cpp#L97 Any idea why 16 secs? Any plans to make it configurable?
s

sharvil

08/01/2022, 2:05 PM
I have come across that limit too, we don’t know why it’s hardcoded to 16 seconds — nothing the in the git logs..I think it should be okay to make it configurable