search

osquery / osquery-go

Go bindings for osquery
MIT License
388 stars 79 forks source link

``osqueryd`` claims shutdown request failed when exiting from SIGINT #65

Open anshukla opened 6 years ago

anshukla commented 6 years ago

I've written a basic osquery table extension using osquery-go. I confirmed that osquery{d,i} can load the extension and query my table as intended. However, when I try to quit osquery with ctrl+C, I see from osquery:

I0729 08:43:05.621091 134004736 extensions.cpp:220] Extension UUID 7951 shutdown request failed

I run osqueryd with:

sudo ./osqueryd --pidfile=osquery.pid --database_path=osquery.db --verbose=true --config_plugin=filesystem --config_path=osquery_test.conf --logger_plugin=filesystem --allow_unsafe --extensions_autoload=extensions.load

Is this expected with the default behavior of Shutdown()? Should I be implementing this signal handling logic myself? I should clarify that the extension process does quit, but I am wondering if the error is avoidable.

zwass commented 6 years ago

What version of osquery-go are you using? We made some changes recently that should have fixed this.

anshukla commented 6 years ago

I have tip of tree checked into vendor. Perhaps it's related, then, to this test failure? https://circleci.com/gh/kolide/osquery-go/240