Channels
  • g

    groob

    3 years ago
    there’s an old patch @theopolis added to thrift in https://github.com/facebook/osquery/blob/experimental/tools/provision/formula/thrift.rb it’s possible that it’s not being applied to the linux builds?
  • akindyakov

    akindyakov

    3 years ago
    Yes, it is possible. Let me check this out
  • g

    groob

    3 years ago
    any insights yet?
  • akindyakov

    akindyakov

    3 years ago
    So sorry, didn't have a chance to look on it today. Probably will do it tomorrow.
    Ok, I could not reproduce the problem on experimental build either on debug and release builds. Is it only
    master
    branch failure?
  • g

    groob

    3 years ago
    Possible.. are you building on linux?
  • akindyakov

    akindyakov

    3 years ago
    Yep, ubuntu 18.04.1
  • g

    groob

    3 years ago
    Ok. I’ve been pulling the binary from master. Interesting
    I’ll build on Linux with buck today and update the issue
    @User can you try reversing the arguments:
    "query": "select * from users cross join shell_history using (uid);",

    i noticed that i don’t get the issue with
    SELECT * FROM shell_history JOIN users on (uid);
  • akindyakov

    akindyakov

    3 years ago
    There is no crash in my test even with your query, but I can see in the log:
    Thrift: Fri Jan 18 16:37:42 2019 TSocket::open() connect() <Host:  Port: 0>Connection refused
    I0118 16:37:42.519556  7636 extensions.cpp:309] Extension UUID 22549 has gone away
    . It it the thing what you talking about?
  • g

    groob

    3 years ago
    yes, there’s an interrupt on thrift
    Thrift: Thu Dec 13 20:30:08 2018 TSocket::read() THRIFT_POLL() Interrupted system call
    Thrift: Thu Dec 13 20:30:08 2018 TConnectedClient died: Unknown: Interrupted system call
    this happens too
    and
    2019/01/15 15:12:52 extension ping failed: write unix @->/osq/osquery.sock: write: broken pipe
    Thrift: Tue Jan 15 15:12:52 2019 TSocket::open() connect() <Host:  Port: 0>Connection refused
    I0115 15:12:52.873929    19 extensions.cpp:304] Extension UUID 63914 has gone away
  • akindyakov

    akindyakov

    3 years ago
    Yes, I see. I will have a look and fix it if possible. Thank you for your help to reproduce it!