system_info table reporting -1 as physical memory on Windows Server

[Kunal5103]

Bug report

What operating system and version are you using?

Windows Server

What version of osquery are you using?

osqueri 5.7.0

What steps did you take to reproduce the issue?

select physical_memory from system_info;

What did you expect to see?

actual ram value

What did you see instead?

-1

[Smjert]

Hello @Kunal5103, would it be possible to:

1. Know which version of Windows Server
2. Know if this is bare metal or a VM. If a VM which virtualization software
3. Run the query via osqueryi enabling verbose mode with --verbose and posting the logs. The table should log a message like "Got error trying to determine the physically installed memory: "

Thank you!

[Kunal5103]

Hi @Smjert this problem is coming on VMware Virtual Platform (windows server 2016 standard and windows server 2019 standard)

[Kunal5103]

VMware Workstation Pro is the name of the virtualization software

what is the solution to this issue

[Kunal5103]

Do I need to Enable any property?

[Kunal5103]

Hi @Smjert

Awaiting for your response.

[Kunal5103]

[rjdunlap]

I'm getting the issue today (5.12.1) on Virtualbox Windows

[rjdunlap]

[Smjert]

This seems to be a limitation of the Windows API used more than a bug: https://github.com/osquery/osquery/blob/fae29d081af4998823571e0ecc6d4e0c5b8d52eb/osquery/tables/system/windows/system_info.cpp#L73-L87

It needs SMBIOS data; for Virtual Box make sure that's enabled. I found this, not sure if it's still relevant: https://forums.virtualbox.org/viewtopic.php?p=444280&sid=b9e63362892d3cd231ee833d4a619068#p444280