https://github.com/osquery/osquery logo
#general
Title
# general
c

charles

01/19/2023, 12:46 AM
anyone ever had issues with the routes table hanging? it seems to be stuck in the
NLMSG_OK
loop in https://github.com/osquery/osquery/blob/613028a6384d4e0b101fe087717c2dfdcde3efbf/osquery/tables/networking/linux/routes.cpp#L241 as I can see all the other stuff happening during a
strace
. it receives a message once and then gets stuck in a recv/sleep loop with no data being passed. not sure if there's a better channel than this one for general osquery debug stuff.
r

Ryan Mack

01/19/2023, 1:00 AM
One of our customers hit this and we ended up reimplementing the retry/timeout here. I’ll post a PR tomorrow.
z

zwass

01/19/2023, 5:02 PM
Thanks Ryan!
c

charles

01/20/2023, 9:50 PM
thank you ryan! i'm sure you can't share too many details, but i'd imagine the root cause for most folks here is docker (seemingly) creating 4 different v6 routes for every container leading to an extremely large v6 routing table.
r

Ryan Mack

01/20/2023, 9:56 PM
The box we saw this on had 96 cores and 384GB of memory. Needless to say it had a lot of containers running on it :-)
c

charles

01/20/2023, 9:56 PM
lol we have almost exactly the same SKU. 🙂 the actual number seems to be around 15 when the table gets sad
4 Views