-
-
Notifications
You must be signed in to change notification settings - Fork 2.6k
Description
Bug report
What operating system and version are you using?
platform = amzn
version = 2
What version of osquery are you using?
version = 5.18.1
What steps did you take to reproduce the issue?
- Maintain an
osquery.confwhosescheduleincludes queries against virtual tables provided by Thrift extensions (autoloaded via--flagfilewithextensions_autoload/extensions_socket, etc.). - Run the upstream profiler against that config, e.g.
python3 tools/analysis/profile.py --config /path/to/osquery.conf --shell /path/to/osqueryi - Observe that
profile.pyinvokesosqueryiwith--disable_extensions, so extension tables are never loaded. - If extensions are enabled (e.g. by passing
--flagfileand omitting--disable_extensions), run with--profileas the stock script does:osqueryistill uses the profile code path instartShellthat does not callrunner.start()(osquery/main/main.cpp), so the extension manager / normal shell init does not match interactiveosqueryi, and extension-backed queries still fail or do not reflect production behavior. - For comparison, run the same scheduled SQL from interactive
osqueryiwith the same flagfile: queries succeed.
Related reports: #6907 (core tables + --profile), #7816 (CLI query vs extension load order; --extensions_require).
What did you expect to see?
One of the following, clearly documented or implemented:
-
If intentional: Explicit documentation that stock
profile.py/osqueryi --profileare not meant to profile extension-backed scheduled queries, and guidance for supported workflows (e.g. interactive +--extensions_require, or another recommended approach). -
If not intentional: Profiler and/or shell profile path should allow profiling scheduled queries under the same init as normal
osqueryi(extensions autoloaded, extension tables available), so performance numbers match whatosquerydwould run in production.
Question for maintainers: Is the current combination of --disable_extensions in profile.py and --profile skipping runner.start() intentional for scope/performance, or should this be treated as a bug / feature gap?
What did you see instead?
no such table: <extension_table>when using stockprofile.py(extensions disabled), and/or- Extension tables still unavailable or behavior diverging from interactive shell when using
--profile, even if extensions are enabled via flagfile.