Closed zwass closed 7 years ago
The latest commit simplifies things and also gets it working again.
All examples seem to be working now, with the exception of the autoloaded extensions (example_distributed
, example_logger
). It is not clear to me whether this is due to an issue with extension autoloading on windows (I suspect it is), or some problem with the code here.
Example output:
PS E:\src\github.com\kolide\osquery-go> C:\ProgramData\osquery\osqueryd\osqueryd.exe --pidfile=C:\ProgramData\osquery\osqueryd.pidfile --db_path C:\ProgramData\osquery\osquery.db --config_path=C:\ProgramData\osquery\osquery.conf --logger_path=C:\ProgramData\osquery\logs --verbose --extensions_autoload=.\extensions_windows.load --disable_distributed=false --distributed_plugin=example_distributed --extensions_timeout=3 --extensions_interval=3
I0922 16:58:24.127060 7076 process_ops.cpp:181] Unable to find environment variable (0): OSQUERY_WORKER
I0922 16:58:24.128614 7076 init.cpp:392] osquery initialized [version=2.7.0]
I0922 16:58:24.129511 7076 process_ops.cpp:181] Unable to find environment variable (203): OSQUERY_WORKER
I0922 16:58:24.239887 7076 system.cpp:322] Found stale process for osqueryd (1212)
I0922 16:58:24.240885 7076 system.cpp:357] Writing osqueryd pid (5284) to C:\ProgramData\osquery\osqueryd.pidfile
I0922 16:58:24.241822 7076 process_ops.cpp:181] Unable to find environment variable (203): OSQUERY_WORKER
I0922 16:58:24.256151 7076 process_ops.cpp:181] Unable to find environment variable (203): OSQUERY_EXTENSIONS
I0922 16:58:24.344974 5016 process_ops.cpp:181] Unable to find environment variable (203): OSQUERY_EXTENSIONS
I0922 16:58:24.350349 5016 watcher.cpp:513] osqueryd watcher (5284) executing worker (6280)
I0922 16:58:24.372860 7708 init.cpp:389] osquery worker initialized [watcher=5284]
I0922 16:58:24.376664 7708 rocksdb.cpp:214] Opening RocksDB handle: C:\ProgramData\osquery\osquery.db
I0922 16:58:24.440996 6664 interface.cpp:327] Extension manager service starting: \\.\pipe\osquery.em
I0922 16:58:24.486178 7708 process_ops.cpp:181] Unable to find environment variable (203): OSQUERY_EXTENSIONS
E0922 16:58:24.488234 7708 init.cpp:568] Cannot activate example_distributed distributed plugin: Unknown registry plugin: example_distributed
I0922 16:58:24.490846 6664 interface.cpp:89] Thrift message: TPipeServer ConnectNamedPipe GLE=errno = 995
I0922 16:58:24.490846 6664 interface.cpp:89] Thrift message: TServerTransport died: TPipeServer: client connection failed
(It looks like osquery does not wait for the distributed plugin to attempt to register before declaring that it cannot be found)
I'd like to merge this despite the issues with autoloading extensions. I don't think it's worth prioritizing those issues at the moment, but I also don't want to leave this PR hanging any longer.
I think that's a good idea @zwass. Let's just update the deps to use dep
and ship it.
Note
7015aae
seems to work:Whereas the attempted refactoring
a948e93
does not: