launcher
launcher copied to clipboard
Can launcher handle osquery database corruption?
I've seen the occasional debug log that has osquery failing to start and dumping errors like:
{"caller":"rocksdb.cpp:149","component":"osquery","level":"info","msg":"I0623 14:42:31.630718 24216 rocksdb.cpp:149] Rocksdb open failed (5:9) IO error: No such file or directoryNewRandomAccessFile failed to Create/Open: C:\\Program Files\\Kolide\\Launcher-kolide-k2\\data\\osquery.db/033233.ldb: The system cannot find the file specified.","osqlevel":"stderr","ts":"2022-06-23T18:42:31.6307194Z"}
{"caller":"rocksdb.cpp:67","component":"osquery","level":"info","msg":"I0623 14:42:31.841513 24216 rocksdb.cpp:67] RocksDB: [WARN] [db\\db_impl\\db_impl_open.cc:1805] Persisting Option File error: OK","osqlevel":"stderr","ts":"2022-06-23T18:42:31.8417064Z"}
{"caller":"rocksdb.cpp:149","component":"osquery","level":"info","msg":"I0623 14:42:31.841706 24216 rocksdb.cpp:149] Rocksdb open failed (5:9) IO error: No such file or directoryNewRandomAccessFile failed to Create/Open: C:\\Program Files\\Kolide\\Launcher-kolide-k2\\data\\osquery.db/033233.ldb: The system cannot find the file specified.","osqlevel":"stderr","ts":"2022-06-23T18:42:31.8417064Z"}
{"caller":"rocksdb.cpp:67","component":"osquery","level":"info","msg":"I0623 14:42:32.057461 24216 rocksdb.cpp:67] RocksDB: [WARN] [db\\db_impl\\db_impl_open.cc:1805] Persisting Option File error: OK","osqlevel":"stderr","ts":"2022-06-23T18:42:32.0577559Z"}
{"caller":"rocksdb.cpp:149","component":"osquery","level":"info","msg":"I0623 14:42:32.057754 24216 rocksdb.cpp:149] Rocksdb open failed (5:9) IO error: No such file or directoryNewRandomAccessFile failed to Create/Open: C:\\Program Files\\Kolide\\Launcher-kolide-k2\\data\\osquery.db/033233.ldb: The system cannot find the file specified.","osqlevel":"stderr","ts":"2022-06-23T18:42:32.0577559Z"}
{"caller":"rocksdb.cpp:67","component":"osquery","level":"info","msg":"I0623 14:42:32.275763 24216 rocksdb.cpp:67] RocksDB: [WARN] [db\\db_impl\\db_impl_open.cc:1805] Persisting Option File error: OK","osqlevel":"stderr","ts":"2022-06-23T18:42:32.2759687Z"}
{"caller":"rocksdb.cpp:149","component":"osquery","level":"info","msg":"I0623 14:42:32.275967 24216 rocksdb.cpp:149] Rocksdb open failed (5:9) IO error: No such file or directoryNewRandomAccessFile failed to Create/Open: C:\\Program Files\\Kolide\\Launcher-kolide-k2\\data\\osquery.db/033233.ldb: The system cannot find the file specified.","osqlevel":"stderr","ts":"2022-06-23T18:42:32.2759687Z"}
{"caller":"shutdown.cpp:79","component":"osquery","level":"info","msg":"E0623 14:42:32.485754 24216 shutdown.cpp:79] IO error: No such file or directoryNewRandomAccessFile failed to Create/Open: C:\\Program Files\\Kolide\\Launcher-kolide-k2\\data\\osquery.db/033233.ldb: The system cannot find the file specified.","osqlevel":"stderr","ts":"2022-06-23T18:42:32.4861538Z"}
{"caller":"runner.go:326","err":"exit status 1","level":"info","mode":"-rw-rw-rw-","msg":"Error running osquery command","path":"C:\\Program Files\\Kolide\\Launcher-kolide-k2\\bin\\osqueryd.exe-updates\\1643084533\\osqueryd.exe","sha256":"8f5489b4dfd0cec93290603ee9df83970ca9459b0131cd6d06cab038b7b3d58d","sizeBytes":20664496,"ts":"2022-06-23T18:42:32.7623652Z"}
{"caller":"runner.go:365","err":"could not create an extension server: timeout after 10s (52 attempts): dialing pipe '\\\\.\\pipe\\kolide-osquery-01G68XYTH4P3VG5XJWWFJS03R6': open \\\\.\\pipe\\kolide-osquery-01G68XYTH4P3VG5XJWWFJS03R6: The system cannot find the file specified.","level":"info","msg":"Unable to create initial extension server. Stopping","ts":"2022-06-23T18:42:37.0467612Z"}
so I wonder, can launcher notice this and clear the osquery database.