Channels
- s
slevchenko
4 months agoHi everyone. Does anybody know how this message affects osqueryd ? I see couple dozens of such messages right after daemon start:osqueryd[36060]: I0130 16:44:32.672724 36192 systemstatetracker.cpp:294] Created empty process context for pid 38689. Fields will show up empty osqueryd[36060]: I0130 16:44:32.673085 36192 systemstatetracker.cpp:294] Created empty process context for pid 38691. Fields will show up empty - a
alessandrogario
4 months agoWhen a new process event is handled, it will look for the parent process inside the internal cache. The internal cache may not have the parent process, this could be due to lost events or discrepancies in the cache. This cache is created on startup and reset once in a while by scanning /proc, and there's a chance for race conditions. It's more common for processes that start/stop in rapid succession, like for example an http server handling connections by forking
View count: 1