Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Launcher autoupdate potentially, occasionally does not shut down osqueryd process properly #1599

Closed
RebeccaMahany opened this issue Feb 14, 2024 · 2 comments · Fixed by #1657

Comments

@RebeccaMahany
Copy link
Contributor

Immediately after the last two launcher releases, I've gotten alerts for logs matching this osquery issue: osquery/osquery#7796. The most recent device in question had autoupdated itself already, and the logs reported that the "non-osqueryd process" using the PID file has a parent cmdline that matches launcher.

It seems possible/likely that when launcher autoupdates itself and reloads, it is not always shutting down osquery. This issue is for investigating and confirming this theory, and adjusting launcher autoupdate restart behavior to avoid the problem. (Potentially, ensuring properly sequenced and completed shutdown is something we want to address in #1205 instead.)

@directionless
Copy link
Contributor

Thinking about it... There are really 2 issues here.

The first issue is that maybe we're not shutting down osquery properly. And while osquery might eventually exit, this is probably covered by #1205

But the second issue is that we cannot start osquery up, when the prior one is still running. And I find myself wondering, can we alleviate this by using an osquery pid file unique to the launcher pid?

@RebeccaMahany
Copy link
Contributor Author

Saw this again after the release to v1.6.1 today

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants