Skip to content

Implement log buffering for all logger plugins #7100

Open
@sroache

Description

@sroache

Bug report

Found through code inspection after osquery stopped when an error status was returned from a custom logger logString call.

If the (last) logString call returns an error status osquery terminates but at this point the results have already been added to the differential database, which would mean that you don't these results the next time the query runs even though it wasn't successfully logged.
https://github.com/osquery/osquery/blob/master/osquery/dispatcher/scheduler.cpp#L178
https://github.com/osquery/osquery/blob/master/osquery/logger/logger.cpp#L436

Is this intentional behaviour?

What operating system and version are you using?

 version = 10.0.19041
   build = 19041
platform = windows

What version of osquery are you using?

version = 4.6.0

What steps did you take to reproduce the issue?

I made sure this happens by using a simple python logger plugin that always caused an error with a scheduled query over the running processes

import osquery
from osquery.extensions.ttypes import ExtensionStatus

@osquery.register_plugin
class TestLogger(osquery.LoggerPlugin):
    def name(self):
        return "TestLoggerPlugin"

    def log_string(self, value):
        print(value)
        return ExtensionStatus(code=1, message="FAIL",)


if __name__ == "__main__":
    osquery.start_extension(name="test_extension", version="1.0.0")

What did you expect to see?

The results that were sent and failed to log sent again on the next query

What did you see instead?

No results sent to the logger plugin the second time

Activity

theopolis

theopolis commented on Jun 9, 2021

@theopolis
Member

I see, I think we should fix this and have a more sensical transaction. We have log buffering for several plugins. It makes sense to make this behavior more generic and apply it to all of the plugins.

added and removed
triageIssue needs to be verified, reproduced and prioritized
on Jun 9, 2021
changed the title Differential results are stored before sending the results to the logger Implement log buffering for all logger plugins on Jun 9, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

      Implement log buffering for all logger plugins · Issue #7100 · osquery/osquery