Schnoogemetzger
08/04/2021, 9:44 AMseph
08/04/2021, 4:06 PMvaar
08/10/2021, 9:35 PMSchnoogemetzger
09/01/2021, 1:02 PMSELECT * FROM file AS foo WHERE foo.path like '/home/user/logtester/%%' AND foo.mtime >= (SELECT strftime('%s','now')-120) AND EXISTS ( SELECT * FROM file_events AS bar WHERE bar.action in ('MOVED_TO','DELETED','ATTRIBUTES_MODIFIED','UPDATED') AND foo.path = bar.target_path AND foo.mtime > bar.mtime AND foo.size < bar.size );
If this query is configured I get the following error:
Error adding new results to database for query file_events: JSON object was not an array
If I'm going to change the query a little bit and ensure that the file_events will be queried first, than there are no errors:
SELECT * FROM file_events AS bar WHERE bar.action in ('MOVED_TO','DELETED','ATTRIBUTES_MODIFIED','UPDATED') AND EXISTS ( SELECT * FROM file AS foo WHERE foo.path like '/home/user/logtester/%%' AND foo.path = bar.target_path AND foo.mtime > bar.mtime AND foo.size < bar.size AND foo.mtime >= (SELECT strftime('%s','now')-120));
I could live with this solution, but it doesn't work with scheduling. I can see with the daemon verbose mode, that the query will be executed, but the results will not be logged. If I'm going to do the same select with osqueryi I got my results as expected.
So I'm a little bit clueless right now and I ask myself: Is it even possible to monitor decreasing files with the FIM functionality of osquery?
We need this if, for example, someone deletes lines from log files.
Do you have any further idea how to do this?zwass
09/07/2021, 2:10 PMError adding new results to database for query file_events: JSON object was not an array
-- This looks like a bug that should be addressed. Can you please file an issue on GitHub?Schnoogemetzger
09/07/2021, 2:18 PMzwass
09/07/2021, 2:57 PMSchnoogemetzger
09/09/2021, 7:03 AMseph
09/17/2021, 3:57 PM