Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Osquery checkup returns "failed to run" on Windows even when successful #1892

Open
RebeccaMahany opened this issue Oct 16, 2024 · 4 comments · Fixed by #1958
Open

Osquery checkup returns "failed to run" on Windows even when successful #1892

RebeccaMahany opened this issue Oct 16, 2024 · 4 comments · Fixed by #1958
Assignees

Comments

@RebeccaMahany
Copy link
Contributor

On Windows, doctor output looks like this for the osquery checkup:

Osquery: failed to run: running launcher interactive: running C:\ProgramData\Kolide\Launcher-kolide-k2\data\updates\launcher\1.11.2\launcher.exe interactive: err exit status 1, output +-------+--------------------------------------+--------------------------------------+---------+------------------------------------------+--------------+------------+----------------+--------------+------------+---------+---------------+
| pid   | uuid                                 | instance_id                          | version | config_hash
                   | config_valid | extensions | build_platform | build_distro | start_time | watcher | platform_mask |
+-------+--------------------------------------+--------------------------------------+---------+------------------------------------------+--------------+------------+----------------+--------------+------------+---------+---------------+
| redacted | redacted | redacted | 5.13.1  | redacted | 1            | active     | windows        | 10           | 1729106122 | -1      | 2             |
+-------+--------------------------------------+--------------------------------------+---------+------------------------------------------+--------------+------------+----------------+--------------+------------+---------+---------------+

I think the interactive query is running successfully, but then the interactive process remains running, and eventually we hit the timeout?

We did launcher interactive over something like runsimple to test launcher <=> osquery communication, but if there's no other way to fix this, we should just switch to runsimple.

@directionless
Copy link
Contributor

directionless commented Nov 15, 2024

Yeah -- my memory is that we did it this way to test 3 things. (Which is a little clever, but it's a bit of a e2e test)

  1. Does interactive work?
  2. Does launcher - osquery socket work?
  3. Record the output, make sure it finds the right osquery, etc

Of those, I think the first two are more important, and run simple won't test those.

@RebeccaMahany
Copy link
Contributor Author

I was thinking that if we're having issues with 2), we'd see that reflected in the logs anyway -- but true re: interactive. I'll see if I can get it figured out!

@directionless
Copy link
Contributor

I assume this is weird fallout from that whole shift to windowsgui

@RebeccaMahany RebeccaMahany reopened this Nov 22, 2024
@RebeccaMahany
Copy link
Contributor Author

We fixed the timeout issue, but I see a new one on v1.12.3 of launcher -- reopened.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants