osquery / osquery/osquery

osqueryd is unable to retrieve some information when I do left join on two tables

Open
#7,948 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Linux triage virtual tables
Dominant language
C++
Stars
23.6k
Forks
2.6k
Avg merge
6d 7h
Merged PRs (30d)
14

Description

I am using the latest osqueryd version 5.7 on my linux machine.

When i left joined processes and listening ports osqueryd is unable to retrive some information and its showing this kind of error i have shared below

I0224 11:47:25.384510 31235 config.cpp:505] Normal configuration delay restored
I0224 11:47:26.254513 31244 proc.h:267] Exception iterating process file descriptors: boost::filesystem::directory_iterator::construct: No such file or directory: "/proc/31162/fd"
I0224 11:47:26.254549 31244 process_open_sockets.cpp:76] Results for process_open_sockets might be incomplete. Failed to acquire socket inode to process map for pid 31162: boost::filesystem::directory_iterator::construct: No such file or directory: "/proc/31162/fd"
I0224 11:47:26.254577 31244 process_open_sockets.cpp:105] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET icmp: Could not open socket information from /proc/31162/net/icmp
I0224 11:47:26.254585 31244 process_open_sockets.cpp:113] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET6 icmp: Could not open socket information from /proc/31162/net/icmp6
I0224 11:47:26.254591 31244 process_open_sockets.cpp:105] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET tcp: Could not open socket information from /proc/31162/net/tcp
I0224 11:47:26.254598 31244 process_open_sockets.cpp:113] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET6 tcp: Could not open socket information from /proc/31162/net/tcp6
I0224 11:47:26.254606 31244 process_open_sockets.cpp:105] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET udp: Could not open socket information from /proc/31162/net/udp
I0224 11:47:26.254611 31244 process_open_sockets.cpp:113] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET6 udp: Could not open socket information from /proc/31162/net/udp6
I0224 11:47:26.254619 31244 process_open_sockets.cpp:105] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET udplite: Could not open socket information from /proc/31162/net/udplite
I0224 11:47:26.254626 31244 process_open_sockets.cpp:113] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET6 udplite: Could not open socket information from /proc/31162/net/udplite6
I0224 11:47:26.254634 31244 process_open_sockets.cpp:105] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET raw: Could not open socket information from /proc/31162/net/raw
I0224 11:47:26.254640 31244 process_open_sockets.cpp:113] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET6 raw: Could not open socket information from /proc/31162/net/raw6
I0224 11:47:26.254648 31244 process_open_sockets.cpp:121] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_UNIX: Could not open socket information from /proc/31162/net/unix

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading proc.h and process_open_sockets.cpp around the logged failures, then reproduce the left join between processes and listening ports on Linux. Check how disappearing /proc/ entries are handled and whether they explain the incomplete results; done means the behavior is explained and, if confirmed as a bug, covered by an appropriate regression test.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, linux, sql
Domain
databases, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.