search

osquery / osquery-go

Go bindings for osquery
MIT License
386 stars 78 forks source link

osquery-go without watchdog. #93

Closed cssmason closed 2 years ago

cssmason commented 2 years ago

There is no watchdog be launched unless the enable_extension_watchdog=true

directionless commented 2 years ago

I am not sure I understand this issue. Could you explain more?

cssmason commented 2 years ago

There is one configuration “enable_extensions_watchdog” in osquery. I have enable this feature in osquery flag file. But when i launched osquery, there is no watchdog process being launched.

directionless commented 2 years ago

How are you running osquery? This repo is the go SDK, while it can pass that along as a config option, it does not manage an osquery install.

cssmason commented 2 years ago

Yes, I use osquery golang SDK to develop the extension.exe. I launched osqueryd with this extension.exe and the flags "enable_extension_watchdog=true". But I can not see any watchdog thread of this extension.exe be launched. And I saw the osquery-python repo, there are two features for the watchdog of extension. Ref: https://github.com/osquery/osquery-python/pull/31 But I can not see any code about this feature in osquery-go. Could development team help to enhance this feature?