directionless
commented
7 months ago Thinking about it... There are really 2 issues here.
The first issue is that maybe we're not shutting down osquery properly. And while osquery might eventually exit, this is probably covered by #1205
But the second issue is that we cannot start osquery up, when the prior one is still running. And I find myself wondering, can we alleviate this by using an osquery pid file unique to the launcher pid?
RebeccaMahany
Immediately after the last two launcher releases, I've gotten alerts for logs matching this osquery issue: https://github.com/osquery/osquery/issues/7796. The most recent device in question had autoupdated itself already, and the logs reported that the "non-osqueryd process" using the PID file has a parent cmdline that matches launcher.
It seems possible/likely that when launcher autoupdates itself and reloads, it is not always shutting down osquery. This issue is for investigating and confirming this theory, and adjusting launcher autoupdate restart behavior to avoid the problem. (Potentially, ensuring properly sequenced and completed shutdown is something we want to address in https://github.com/kolide/launcher/issues/1205 instead.)