Skip to content

Implement log buffering for all logger plugins #7100

Open
@sroache

Description

Bug report

Found through code inspection after osquery stopped when an error status was returned from a custom logger logString call.

If the (last) logString call returns an error status osquery terminates but at this point the results have already been added to the differential database, which would mean that you don't these results the next time the query runs even though it wasn't successfully logged.
https://github.com/osquery/osquery/blob/master/osquery/dispatcher/scheduler.cpp#L178
https://github.com/osquery/osquery/blob/master/osquery/logger/logger.cpp#L436

Is this intentional behaviour?

What operating system and version are you using?

 version = 10.0.19041
   build = 19041
platform = windows

What version of osquery are you using?

version = 4.6.0

What steps did you take to reproduce the issue?

I made sure this happens by using a simple python logger plugin that always caused an error with a scheduled query over the running processes

import osquery
from osquery.extensions.ttypes import ExtensionStatus

@osquery.register_plugin
class TestLogger(osquery.LoggerPlugin):
    def name(self):
        return "TestLoggerPlugin"

    def log_string(self, value):
        print(value)
        return ExtensionStatus(code=1, message="FAIL",)


if __name__ == "__main__":
    osquery.start_extension(name="test_extension", version="1.0.0")

What did you expect to see?

The results that were sent and failed to log sent again on the next query

What did you see instead?

No results sent to the logger plugin the second time

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions