What does `return code 78` mean in osquery

Question

Jams · Answer

Can you provide more context Is this reproducible If so how

Zweasta · Answer

`process = subprocess run osqueryi json select from os version stdout=subprocess PIPE stderr=subprocess STDOUT universal newlines=True `

Zweasta · Answer

`print process stdout ` gives no output and when I checked the `return code it says 78`

Zweasta · Answer

And I faced this issue only on a single machine out of 6 machines that I checked on osquery on

Jams · Answer

Exit code 78 is related to pre defined exit codes in both Linux and BSD usr include sysexists h If I had to guess this one outlier has a different version of Python and libraries eggs compared to the 5 functional machines

Zweasta · Answer

I usually run using python3 so I uninstalled and installed the python3 but still no change I still get the 78 error code

Zweasta · Answer

Do you have any idea on how to fix this

Jams · Answer

osquery is a universal interface to collect telemetry and inspect hosts across multiple OS Common usage patterns are running `osqueryd` with filesystem or tls logging

Jams · Answer

It s important to know the exact Python 3 version as subprocess modules behavior does change within the various 3 x variants Try something like ```subprocess Popen command stdout=subprocess PIPE stderr=subprocess PIPE shell=use shell universal newlines=True ```

Zweasta · Answer

Even without python3 subprocess `$osqueryi json select from os version ` ` ` ` build codename major 7 minor 8 name CentOS Linux patch 2003 platform rhel platform like rhel version CentOS Linux release 7 8 2003 Core ` ` `

Zweasta · Answer

`$echo $ ` `78`

Zweasta · Answer

I am getting output in this way but at the end after printing ` ` in the above output it `hangs for 2 seconds` and the osqueryi process ends But when I check the return code It says 78

seph · Answer

I think I found it Still digging

seph · Answer

Seems to happen if I specify an extension that cannot be executed eg ```touch no exec osqueryd ephemeral extension `pwd` no exec allow unsafe```

seph · Answer

Missing extensions produce the same errors

seph · Answer

< Zweasta> Does your config point to an extension that s missing or broken

seph · Answer

Though I do see that in the stderr output

Zweasta · Answer

< seph> The issue is resolved using this ` config plugin=filesystem config path= dev null`

seph · Answer

Do you know why

Zweasta · Answer

Nope I didn t dig further As it was only seen in one single machine I got this solution from < theopolis> Maybe he must be having some more info regarding this

seph · Answer

I m glad it solved your problem I expect stderr would have more information and I might guess there s something pointing at a bad extension

Zweasta · Answer

Yep I think the same

theopolis · Answer

Sorry I haven t had time to help debug further I ll DM you now

seph · Answer

< theopolis> I tossed some notes into a github issue May not be news to you

theopolis · Answer

Yeah I wanted to explore the actual configuration in use It s better to do that privately

seph · Answer

+1