osquery / osquery/osquery-go

``osqueryd`` claims shutdown request failed when exiting from SIGINT

Open
#65 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
433
Forks
89
PR merge metrics
No merged PRs in 30d

Description

I've written a basic osquery table extension using osquery-go. I confirmed that osquery{d,i} can load the extension and query my table as intended. However, when I try to quit osquery with ctrl+C, I see from osquery:

I0729 08:43:05.621091 134004736 extensions.cpp:220] Extension UUID 7951 shutdown request failed

I run osqueryd with:

sudo ./osqueryd --pidfile=osquery.pid --database_path=osquery.db --verbose=true --config_plugin=filesystem --config_path=osquery_test.conf --logger_plugin=filesystem --allow_unsafe --extensions_autoload=extensions.load

Is this expected with the default behavior of Shutdown()? Should I be implementing this signal handling logic myself? I should clarify that the extension process does quit, but I am wondering if the error is avoidable.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing Shutdown() in the osquery-go extension behavior and the shutdown request logged at extensions.cpp:220. Reproduce the SIGINT flow with the provided osqueryd command and determine whether the failed request is expected; done means confirming the behavior and identifying whether it should be avoided or documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.