Open
Description
Bug report
What operating system and version are you using?
Description: Ubuntu 20.04.3 LTS
Release: 20.04
Codename: focal
What version of osquery are you using?
5.2.3
What steps did you take to reproduce the issue?
-
Open a brand new EC2 Ubuntu instance
-
Install osquery by performing the following
sudo apt-get install -y gnupg software-properties-common python3-pip
export debian_frontend=noninteractive
export osquery_key=1484120ac4e9f8a1a577aeee97a80c63c9d8b80b
sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys $osquery_key
sudo add-apt-repository 'deb [arch=amd64] https://pkg.osquery.io/deb deb main'
sudo apt-get -y update
sudo apt-get -y install osquery
pip3 install osquery==3.0.7
- Run this small reproducible example:
import osquery
import time
instance = osquery.SpawnInstance()
instance.open()
for i in range(5):
# throws error in third iteration of `i`
query = instance.client.query("select * from deb_packages")
print(query.response)
time.sleep(2)
- The following error during the third iteration of the loop:
Traceback (most recent call last):
File "/home/ubuntu/.local/lib/python3.10/site-packages/thrift/transport/TSocket.py", line 178, in write
plus = self.handle.send(buff)
BrokenPipeError: [Errno 32] Broken pipe
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/home/ubuntu/osquery_demo.py", line 9, in <module>
query = instance.client.query("select * from deb_packages")
File "/home/ubuntu/.local/lib/python3.10/site-packages/osquery/extensions/ExtensionManager.py", line 181, in query
self.send_query(sql)
File "/home/ubuntu/.local/lib/python3.10/site-packages/osquery/extensions/ExtensionManager.py", line 190, in send_query
self._oprot.trans.flush()
File "/home/ubuntu/.local/lib/python3.10/site-packages/thrift/transport/TTransport.py", line 179, in flush
self.__trans.write(out)
File "/home/ubuntu/.local/lib/python3.10/site-packages/thrift/transport/TSocket.py", line 185, in write
raise TTransportException(message="unexpected exception", inner=e)
thrift.transport.TTransport.TTransportException: unexpected exception
What did you expect to see?
I expected osquery to return the query result for deb_packages 5 times(in the above demo example).
What did you see instead?
osquery successfully returned deb_packages two times in the loop but raised a BrokenPipeError exception on the third iteration of the loop.
Metadata
Metadata
Assignees
Labels
No labels