https://github.com/osquery/osquery logo
#general
Title
# general
t

thor

02/13/2020, 8:30 PM
@Stefano Bonicatti mentioned it in the thread, I've seen this happen when you've attempted to upgrade and the service is actively running, we should cut an issue to try and fix that behavior, as osquery really shouldn't require a reboot when installing/upgrading/stoping/uninstalling/...
s

shortstack

02/13/2020, 8:32 PM
agreed... shouldn't require reboot
s

seph

02/13/2020, 8:34 PM
Maybe… As said, I’ve see the service controller wedge
s

shortstack

02/13/2020, 8:37 PM
what do you mean "wedge"
s

seph

02/13/2020, 8:43 PM
I never wrote this up, but… If you have the service control panel up, and an MSI tries to change a service definition or swap it, something gets irrevocably wedged. I didn’t trace this to whether it was all service control stuff, or just the service in question.
But somewhere, there’s a big ugly single thread without adequate protection, and it can corrupt itself.
🤦 1
I’m convinced this is why a lot of commercial windows tools insist on rebooting.
I have not toggled the kolide MSI to requiring a reboot, but I’m tempted to.
s

shortstack

02/13/2020, 8:46 PM
ugh :(
s

seph

02/13/2020, 8:46 PM
Yeah. I was… displeased.
s

shortstack

02/13/2020, 8:47 PM
it just seems crazy to me that it's only happened once after literally thousands.
s

seph

02/13/2020, 8:47 PM
¯\_(ツ)_/¯
Sorta implies it’s may not be easy to adjust
s

shortstack

02/13/2020, 9:05 PM
yea