launcher icon indicating copy to clipboard operation
launcher copied to clipboard

Windows sometimes hangs

Open directionless opened this issue 2 years ago • 0 comments

More and more I'm seeing occasions where the windows agent hangs.

Symptomatically, I see things like distributed queries hanging, while scheduled ones continue. Inside K2, we sometimes see last seen remain current, but live query stops working. Etc.

I suspect there's a query that hangs, somewhere. Might be osquery, might be launcher. And what we see is the osquery distributed thread hang, but the scheduled one remains. My hunch is that it's somehow WMI related, but I don't have any evidence to back that up.

I wonder if we can:

  • still get a flare, that's a different code path
  • add more debug logs to capture ???
  • detect and remediate?

directionless avatar Nov 07 '23 14:11 directionless