Hi I compiled the osquery extensions from trailofbits and I

Question

Hi I compiled the osquery extensions from trailofbits and I have been trying to use the darwin unified log one It loads correctly seen with verbose but when I query the table it should generate the table is always empty can anyone help me out with this one

Mike Myers · Answer

< Garret> do you have the macOS extensions built Is this something you can confirm

Garret · Answer

I have the extension built let me fire up my vm

Garret · Answer

ooooh okay it definitely does not work and looking at the code I don t think it s ever worked there s a pretty clear logic error in there grimacing

Mike Myers · Answer

I ll open an issue

Mike Myers · Answer

Garret · Answer

kk it looks like it got broken back in march when the code was updated to use the DynamicTableRowHolder

Garret · Answer

rather than copying from `new entries` to `entries` at line 197 of system log cpp now it copies from `entries` to `entries`

Stefano Bonicatti · Answer

oups S

grahamgilbert · Answer

unified log is in the macadmins extension btw <https github com macadmins osquery extension>

Sebastiaan · Answer

< Mike Myers> I am sorry for the late response I just saw that there were answers on this message

Mike Myers · Answer

that s ok we don t yet have a fix published