Skip to content

BrokenPipeError when running deb_packages query #86

Open
@SarthakAdhikari

Description

@SarthakAdhikari

Bug report

What operating system and version are you using?

Description: Ubuntu 20.04.3 LTS
Release: 20.04
Codename: focal

What version of osquery are you using?

5.2.3

What steps did you take to reproduce the issue?

  1. Open a brand new EC2 Ubuntu instance

  2. Install osquery by performing the following

    sudo apt-get install -y gnupg software-properties-common python3-pip

    export debian_frontend=noninteractive
    export osquery_key=1484120ac4e9f8a1a577aeee97a80c63c9d8b80b

    sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys $osquery_key
    sudo add-apt-repository 'deb [arch=amd64] https://pkg.osquery.io/deb deb main'
    sudo apt-get -y update
    sudo apt-get -y install osquery


   pip3 install osquery==3.0.7
  1. Run this small reproducible example:
    import osquery
    import time

    instance = osquery.SpawnInstance()
    instance.open()

    for i in range(5):
        # throws error in third iteration of `i`
        query = instance.client.query("select * from deb_packages")
        print(query.response)
        time.sleep(2)
  1. The following error during the third iteration of the loop:
        Traceback (most recent call last):
        File "/home/ubuntu/.local/lib/python3.10/site-packages/thrift/transport/TSocket.py", line 178, in write
            plus = self.handle.send(buff)
        BrokenPipeError: [Errno 32] Broken pipe

        During handling of the above exception, another exception occurred:

        Traceback (most recent call last):
        File "/home/ubuntu/osquery_demo.py", line 9, in <module>
            query = instance.client.query("select * from deb_packages")
        File "/home/ubuntu/.local/lib/python3.10/site-packages/osquery/extensions/ExtensionManager.py", line 181, in query
            self.send_query(sql)
        File "/home/ubuntu/.local/lib/python3.10/site-packages/osquery/extensions/ExtensionManager.py", line 190, in send_query
            self._oprot.trans.flush()
        File "/home/ubuntu/.local/lib/python3.10/site-packages/thrift/transport/TTransport.py", line 179, in flush
            self.__trans.write(out)
        File "/home/ubuntu/.local/lib/python3.10/site-packages/thrift/transport/TSocket.py", line 185, in write
            raise TTransportException(message="unexpected exception", inner=e)
        thrift.transport.TTransport.TTransportException: unexpected exception

What did you expect to see?

I expected osquery to return the query result for deb_packages 5 times(in the above demo example).

What did you see instead?

osquery successfully returned deb_packages two times in the loop but raised a BrokenPipeError exception on the third iteration of the loop.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions