Osquery - Extensions Threads

Channels

Topic	Authors	Views	Replies	Activity
I'd be fine with writing an events buffer for osquery-go with a backing store if we could figure out how to resolve the events_optimize issue.	s	0	4	1 year ago
I’m pretty sure there’s something weird in the extensions/config. I recall something about how extensions get loaded, because they can create new config sections. (This might only be c++ ones, not thrift ones)	a	0	2	1 year ago
Hi! I compiled the osquery extensions from trailofbits, and I have been trying to use the darwin_unified_log one. It loads correctly (seen with -verbose), but when I query the table it should generate, the table is alway...	s	0	3	1 year ago
Hi, we are seeing deadlock when osquery extension is using multiple threads to share the extension client between them. Is the client is thread safe or we need to create multiple clients	s	1	3	1 year ago
@groob @alessandrogario using osquery-go and trying to grab greater than and less than constraints - it looks like the constraints list is empty when I use `<` or `>` in the query - works fine when using equals o...	s	1	2	1 year ago
Hi, what is reliable way to stop extension, the runner seem to stop dispatcher, event factory etc on calling shutdown() however, when we launch the extension continuously in a loop the agent complains of thrift error as ...	s	0	1	1 year ago
@alessandrogario Do you know how well writable tables are supported outside of the C++ SDK? My impression was that it wasn't possible,but I haven't been very active in the last year. https://github.com/osquery/osquery/b...	g	4	1	1 year ago
anyone know of an extension that exposes appcompat/amcachehive entries as a table?	v	0	2	1 year ago
The example_extension.cpp in the osquery/example folder does not build if I place it in the externals folders. Are they no longer up to date or is there some other method of building them.	v	0	3	2 years ago
hi all, If I have my custom extension, How do I restrict access of my extension only to my APP. I don't want to use remote setting. I want my APP to collect data and send to my server. any suggestions/ pointers?	s	1	4	2 years ago

I'd be fine with writing an events buffer for osquery-go with a backing store if we could figure out how to resolve the events_optimize issue.
4 Replies
1 year ago
s
I’m pretty sure there’s something weird in the extensions/config. I recall something about how extensions get loaded, because they can create new config sections. (This might only be c++ ones, not thrift ones)
2 Replies
1 year ago
s
Hi! I compiled the osquery extensions from trailofbits, and I have been trying to use the darwin_unified_log one. It loads correctly (seen with -verbose), but when I query the table it should generate, the table is alway...
3 Replies
1 year ago
s
Hi, we are seeing deadlock when osquery extension is using multiple threads to share the extension client between them. Is the client is thread safe or we need to create multiple clients
3 Replies
1 year ago
g
@groob @alessandrogario using osquery-go and trying to grab greater than and less than constraints - it looks like the constraints list is empty when I use
<
or
>
in the query - works fine when using equals o...
2 Replies
1 year ago
s
Hi, what is reliable way to stop extension, the runner seem to stop dispatcher, event factory etc on calling shutdown() however, when we launch the extension continuously in a loop the agent complains of thrift error as ...
1 Replies
1 year ago
g
@alessandrogario Do you know how well writable tables are supported outside of the C++ SDK? My impression was that it wasn't possible,but I haven't been very active in the last year.
https://github.com/osquery/osquery/b...
1 Replies
1 year ago
v
anyone know of an extension that exposes appcompat/amcachehive entries as a table?
2 Replies
1 year ago
v
The example_extension.cpp in the osquery/example folder does not build if I place it in the externals folders. Are they no longer up to date or is there some other method of building them.
3 Replies
2 years ago
d
hi all, If I have my custom extension, How do I restrict access of my extension only to my APP. I don't want to use remote setting. I want my APP to collect data and send to my server. any suggestions/ pointers?
4 Replies
2 years ago