nick fury

07/18/2022, 4:57 PM
hello! i have writen mine yara table that scans all the procces at my comuter, it works well when watchdog is disabled, but when he is on he is restarting my oasis procces, do you have any solution to this problem without disabling the watchdog?

Stefano Bonicatti

07/18/2022, 5:06 PM
Hello @nick fury that means you need to tune the watchdog limits and make sure that your extension respects them. The first can be done with changing
. Keep in mind though that the watchdog for extensions is a bit limited, in the sense that those values also affect the osqueryd daemon. There’s only one set of flags for everything basically. For the second thing, that’s the task of the extension developer.