https://github.com/osquery/osquery logo
#windows
Title
# windows
m

MoodyMudit

04/13/2022, 9:58 AM
Hi, I am using the
hash
table in windows and trying to fetch the
sha1
of a few files. However, for some files, I do receive the correct data, while for others I don’t. Can someone please help me understand if there is any reason that I don’t receive the data for some files? I don’t receive the sha1 of
Copy code
windowsdesktop-runtime-5.0.15-win-x86.exe
while I do get the sha1 of
Copy code
svchost.exe
s

Stefano Bonicatti

04/13/2022, 10:03 AM
Hello @MoodyMudit it’s likely that the file size exceeds the default read_max value that osquery has, which prevents too many resources to be used. You might want to increase that value.
osquery will also issue a warning when that happens
m

MoodyMudit

04/13/2022, 10:05 AM
Got it. Thanks a lot Stefano for the quick response.
s

Stefano Bonicatti

04/13/2022, 10:05 AM
“Cannot read <file path> size exceeds limit: <file size> > <limit>”
No problem! (Also, the default limit is 50MB)
8 Views