osquery / osquery/osquery

—logger_numerics doesn’t apply to status logs

Open
#7,150 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

logging triage
Dominant language
C++
Stars
23.6k
Forks
2.6k
Avg merge
6d 7h
Merged PRs (30d)
14

Description

Bug report

What operating system and version are you using?
 version = 10.16
   build = 20F71
platform = darwin
What version of osquery are you using?
What steps did you take to reproduce the issue?

Look at status logs

What did you expect to see?

Numeric fields represented by numbers, not double-quote wrapped strings

{
  "hostIdentifier": "CPU",
  "calendarTime": "Wed Jun  9 18:29:49 2021 UTC",
  "unixTime": 1623263389,
  "severity": 0,
  "filename": "tls.cpp",
  "line": 254,
  "message": "TLS/HTTPS POST request to URI: <redacted>",
  "version": "4.6.0.2",
  "decorations": {
    "host_uuid": "6B20EF86-325D-E911-B2B6-00D861595693",
    "hostname": "CPU"
  }
}
What did you see instead?

Values such as line, severity, and unixTime will always be numeric, yet they are wrapped in double quotes, implying that they are string values. This can cause problems upstream for ingesting these logs when a schema on the data is being enforced.

Sample event:

{
  "hostIdentifier": "CPU",
  "calendarTime": "Wed Jun  9 18:29:49 2021 UTC",
  "unixTime": "1623263389",
  "severity": "0",
  "filename": "tls.cpp",
  "line": "254",
  "message": "TLS/HTTPS POST request to URI: <redacted>",
  "version": "4.6.0.2",
  "decorations": {
    "host_uuid": "6B20EF86-325D-E911-B2B6-00D861595693",
    "hostname": "CPU"
  }
}

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing how status logs are serialized and where logger_numerics is applied. Compare the expected and actual JSON samples, focusing on unixTime, severity, and line. Done means these numeric fields remain JSON numbers rather than quoted strings in status logs.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
observability-sre
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.