osqueryd is unable to retrieve some information when I do left join on two tables
Open
Nobody has claimed this yet.
Linux
triage
virtual tables
- Dominant language
- C++
- Stars
- 23.6k
- Forks
- 2.6k
- Avg merge
- 6d 7h
- Merged PRs (30d)
- 14
Description
I am using the latest osqueryd version 5.7 on my linux machine.
When i left joined processes and listening ports osqueryd is unable to retrive some information and its showing this kind of error i have shared below
I0224 11:47:25.384510 31235 config.cpp:505] Normal configuration delay restored
I0224 11:47:26.254513 31244 proc.h:267] Exception iterating process file descriptors: boost::filesystem::directory_iterator::construct: No such file or directory: "/proc/31162/fd"
I0224 11:47:26.254549 31244 process_open_sockets.cpp:76] Results for process_open_sockets might be incomplete. Failed to acquire socket inode to process map for pid 31162: boost::filesystem::directory_iterator::construct: No such file or directory: "/proc/31162/fd"
I0224 11:47:26.254577 31244 process_open_sockets.cpp:105] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET icmp: Could not open socket information from /proc/31162/net/icmp
I0224 11:47:26.254585 31244 process_open_sockets.cpp:113] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET6 icmp: Could not open socket information from /proc/31162/net/icmp6
I0224 11:47:26.254591 31244 process_open_sockets.cpp:105] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET tcp: Could not open socket information from /proc/31162/net/tcp
I0224 11:47:26.254598 31244 process_open_sockets.cpp:113] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET6 tcp: Could not open socket information from /proc/31162/net/tcp6
I0224 11:47:26.254606 31244 process_open_sockets.cpp:105] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET udp: Could not open socket information from /proc/31162/net/udp
I0224 11:47:26.254611 31244 process_open_sockets.cpp:113] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET6 udp: Could not open socket information from /proc/31162/net/udp6
I0224 11:47:26.254619 31244 process_open_sockets.cpp:105] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET udplite: Could not open socket information from /proc/31162/net/udplite
I0224 11:47:26.254626 31244 process_open_sockets.cpp:113] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET6 udplite: Could not open socket information from /proc/31162/net/udplite6
I0224 11:47:26.254634 31244 process_open_sockets.cpp:105] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET raw: Could not open socket information from /proc/31162/net/raw
I0224 11:47:26.254640 31244 process_open_sockets.cpp:113] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET6 raw: Could not open socket information from /proc/31162/net/raw6
I0224 11:47:26.254648 31244 process_open_sockets.cpp:121] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_UNIX: Could not open socket information from /proc/31162/net/unix
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading proc.h and process_open_sockets.cpp around the logged failures, then reproduce the left join between processes and listening ports on Linux. Check how disappearing /proc/ entries are handled and whether they explain the incomplete results; done means the behavior is explained and, if confirmed as a bug, covered by an appropriate regression test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, linux, sql
- Domain
- databases, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100