``osqueryd`` claims shutdown request failed when exiting from SIGINT
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 433
- Forks
- 89
- PR merge metrics
- No merged PRs in 30d
Description
I've written a basic osquery table extension using osquery-go. I confirmed that osquery{d,i} can load the extension and query my table as intended. However, when I try to quit osquery with ctrl+C, I see from osquery:
I0729 08:43:05.621091 134004736 extensions.cpp:220] Extension UUID 7951 shutdown request failed
I run osqueryd with:
sudo ./osqueryd --pidfile=osquery.pid --database_path=osquery.db --verbose=true --config_plugin=filesystem --config_path=osquery_test.conf --logger_plugin=filesystem --allow_unsafe --extensions_autoload=extensions.load
Is this expected with the default behavior of Shutdown()? Should I be implementing this signal handling logic myself? I should clarify that the extension process does quit, but I am wondering if the error is avoidable.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing Shutdown() in the osquery-go extension behavior and the shutdown request logged at extensions.cpp:220. Reproduce the SIGINT flow with the provided osqueryd command and determine whether the failed request is expected; done means confirming the behavior and identifying whether it should be avoided or documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100