Dmytro Liakhov
03/07/2023, 12:22 PMhardware_events
table using our golang app, But if we run the same query via osqueryi
- it returns such events.
In the golang app it just returns empty response.
This issues stops to be reproducible after I restart osquery daemon - but this trick doesn't always help. I can't see any specific errors in the logs.
could somebody help to troubleshoot this issue?seph
03/07/2023, 6:21 PMDmytro Liakhov
03/07/2023, 8:37 PMI wonder if there’s a sequencing issue. Does the go program start before osquery is ready?yes, it is, I’ve checked status of daemon, it’s active
seph
03/07/2023, 9:28 PMDmytro Liakhov
03/07/2023, 9:52 PMseph
03/07/2023, 10:03 PMDmytro Liakhov
03/08/2023, 9:12 AMosquery> select he.action,he.driver, he.model, he.model_id, he.path, he.revision, he.serial, he.vendor, he.vendor_id, DATETIME(ROUND(he.time), 'unixepoch') as time from hardware_events he;
+--------+--------+-------+----------+----------------------+----------+-------------+--------------+-----------+---------------------+
| action | driver | model | model_id | path | revision | serial | vendor | vendor_id | time |
+--------+--------+-------+----------+----------------------+----------+-------------+--------------+-----------+---------------------+
| remove | | | aaaa | /dev/bus/usb/001/019 | 0314 | 804-932-207 | | 11ca | 2023-03-08 08:51:46 |
| add | usb | | aaaa | /dev/bus/usb/001/020 | 0314 | 804-932-207 | | 11ca | 2023-03-08 08:52:09 |
+--------+--------+-------+----------+----------------------+----------+-------------+--------------+-----------+---------------------+
osquery>
but if I run app I can see that response is empty:
{"ContextLogTag":"/tmp/osquery/router/router.go#64","level":"info","msg":"executing: select he.action,he.driver, he.model, he.model_id, he.path, he.revision, he.serial, he.vendor, he.vendor_id, DATETIME(ROUND(he.time), 'unixepoch') as time from hardware_events he;","time":"2023-03-08T09:10:44Z"}
{"ContextLogTag":"/tmp/osquery/router/router.go#37","level":"info","msg":"response: []","time":"2023-03-08T09:10:44Z"}
[root@uk-9769-000732762e01 osquery]# cat osqueryd.ERROR
Log file created at: 2023/03/08 09:06:55
Running on machine: <id>
Log line format: [IWEF]mmdd hh:mm:ss.uuuuuu threadid file:line] msg
E0308 09:06:55.966769 10195 udev.cpp:89] udev monitor returned invalid device: No buffer space available
I don't know could be this error related to my issue or not
I found similar issue on github https://github.com/osquery/osquery/issues/7758 but it's open stillseph
03/08/2023, 8:26 PMosqueryi and osqueryd are highly coupledSorta the opposite. They are totally separate instances of osquery, and they don’t really share runtime context. I do not know what populates hardware_events, or why it might not be configured correctly on osquieryd
Dmytro Liakhov
03/09/2023, 8:55 AME0308 09:06:55.966769 10195 udev.cpp:89] udev monitor returned invalid device: No buffer space available