osquery / osquery/osquery

Unable to select data from the device_file table even with partition and device columns provided in where clause

Open
#6,423 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Linux triage
Dominant language
C++
Stars
23.6k
Forks
2.6k
Avg merge
6d 7h
Merged PRs (30d)
14

Description

Bug report

What operating system and version are you using?

version = CentOS Linux release 7.7.1908 (Core) build = platform = rhel

What version of osquery are you using?

version = 4.3.0

What steps did you take to reproduce the issue?

My goal is to select a list of rows from the device_file table for known devices. It appears that selecting from that table requires both the partition and device columns be provided in the where clause. In order to identify some test values for the where clause, it appeared that I could utilize the data provided by querying the device_partitions table for a known device

osquery> select device,partition from device_partitions where device='/dev/sda';

+----------+-----------+
| device | partition |
+----------+-----------+
| /dev/sda | 0 |
| /dev/sda | 1 |
| /dev/sda | 2 |
| /dev/sda | 3 |
+----------+-----------+
I then tried to join the device_partitions table to the device_file using the query below, but no results were returned. No errors, but no results. I tried 0-4 for the partition value and nothing was returned for any of them (Partition 4 had the label "primary").

osquery> select * from device_partitions dp join device_file df on dp.device=df.device and dp.partition=df.partition where df.partition=4 and df.device='/dev/sda';

Note I tried it without a join on the device_partitions table and it did not return any results either.

What did you expect to see?

I expected a table of results. It would be helpful also to have the error message that indicates a constraint failed identify the columns required in the where clause within the error message itself.

What did you see instead?

No results.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the reported queries with osqueryi against device_partitions and device_file on the stated osquery 4.3.0 environment. Trace how device_file handles the device and partition constraints. Done means the query returns the expected rows or reports a clear error identifying the required constraints.

Written by the indexing model from the issue text.

Assessment

Tech stack
sql
Domain
databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.