Description
Bug report
Found through code inspection after osquery stopped when an error status was returned from a custom logger logString call.
If the (last) logString call returns an error status osquery terminates but at this point the results have already been added to the differential database, which would mean that you don't these results the next time the query runs even though it wasn't successfully logged.
https://github.com/osquery/osquery/blob/master/osquery/dispatcher/scheduler.cpp#L178
https://github.com/osquery/osquery/blob/master/osquery/logger/logger.cpp#L436
Is this intentional behaviour?
What operating system and version are you using?
version = 10.0.19041
build = 19041
platform = windows
What version of osquery are you using?
version = 4.6.0
What steps did you take to reproduce the issue?
I made sure this happens by using a simple python logger plugin that always caused an error with a scheduled query over the running processes
import osquery
from osquery.extensions.ttypes import ExtensionStatus
@osquery.register_plugin
class TestLogger(osquery.LoggerPlugin):
def name(self):
return "TestLoggerPlugin"
def log_string(self, value):
print(value)
return ExtensionStatus(code=1, message="FAIL",)
if __name__ == "__main__":
osquery.start_extension(name="test_extension", version="1.0.0")
What did you expect to see?
The results that were sent and failed to log sent again on the next query
What did you see instead?
No results sent to the logger plugin the second time