groob
12/02/2018, 12:13 AMAnjali
12/03/2018, 3:09 AMD:\dev\test\3Dec\log\osqueryd.INFO.20181129-212728.3716 (2 hits)
Line 6: I1129 21:27:28.158903 4480 interface.cpp:105] Registering extension (testext, 12976, version=, sdk=)
Line 7: I1129 21:27:28.159905 4480 registry_factory.cpp:109] Extension 12976 registered table plugin testext_table
D:\dev\test\3Dec\log\osqueryd.INFO.20181130-054055.3716 (5 hits)
Line 70714: I1130 07:42:09.150415 4464 extensions.cpp:305] Extension UUID 12976 has gone away
Line 76783: I1130 08:13:51.688372 2400 watcher.cpp:629] Created and monitoring extension child (3864): C:\ProgramData\osquery\testext\testext.exe
Line 77902: I1130 08:15:00.154594 2852 interface.cpp:105] Registering extension (testext, 11586, version=, sdk=)
Line 78234: W1130 08:15:07.172192 2400 watcher.cpp:595] Extension respawning too quickly: C:\ProgramData\osquery\testext\testext.exe
Line 78246: I1130 08:15:07.187816 2400 watcher.cpp:629] Created and monitoring extension child (1012): C:\ProgramData\osquery\testext\testext.exe
D:\dev\test\3Dec\log\osqueryd.INFO.20181130-081508.3716 (9977 hits)
Line 777: I1130 08:15:11.078513 3924 interface.cpp:105] Registering extension (testext, 24354, version=, sdk=)
Line 778: I1130 08:15:11.078513 3924 registry_factory.cpp:84] Extension 24354 has duplicate plugin name: testext_table in registry: table
Line 779: W1130 08:15:11.079512 3924 interface.cpp:111] Could not add extension testext: Duplicate registry item: testext_table
Line 921: W1130 08:15:11.781533 2852 interface.cpp:111] Could not add extension testext: SQLITE_ERROR
Line 923: I1130 08:15:13.328397 4464 extensions.cpp:273] Extension UUID 11586 initial check failed
Line 924: W1130 08:15:13.328397 2400 watcher.cpp:595] Extension respawning too quickly: C:\ProgramData\osquery\testext\testext.exe
Line 925: I1130 08:15:13.328397 2400 watcher.cpp:629] Created and monitoring extension child (4388): C:\ProgramData\osquery\testext\testext.exe
Line 926: I1130 08:15:13.495498 172 interface.cpp:105] Registering extension (testext, 7984, version=, sdk=)
<snip>
... and so it goes