There don't seem to be anyway errors generated by the extension. It runs fine on a certain percentage of hosts and on the hosts it unregisters on, it runs fine via osqueryi
p
packetzero
01/17/2019, 8:58 PM
If it doesn't respond to heartbeat fast enough, will get removed. Try running osqueryd in verbose mode to view some more debug info.
☝️ 1
j
jgshomo
01/17/2019, 9:08 PM
Will do. Thanks
m
Mike Myers
01/21/2019, 8:00 PM
By any chance is this the ntfs_metadata extension where you are seeing occasional timeouts?
j
jgshomo
01/22/2019, 2:13 PM
No, this was separate set of extensions. I think the issue was too many overlapping intervals with a small splay in the test environment. I staggered the intervals a little and increased the splay. That seems to have helped the situation but I still get occasional drops. Wondering if we have too many extension exes. Might need to compile them down into only one or two.