07/12/2022, 10:39 PM
We'd just upgraded some hosts from osquery 5.2.3 to 5.3.0, and had to temporarily revert some of them, back down to 5.2.3. Noting here that the upgrade had made some changes to the database that 5.2.3 was not very happy about, got itself into a restart loop. Error in osqueryd.log was
Invalid argument: Column families not opened: distributed
Stefano Bonicatti

Stefano Bonicatti

07/12/2022, 11:08 PM
Yeah this is a limitation when changing the DB format. Upgrading version is supported, but downgrading is not. You have the remove the DB.