Skip to content

osqueryd is unable to retrieve some information when I do left join on two tables #7948

@mrramachari

Description

@mrramachari

I am using the latest osqueryd version 5.7 on my linux machine.

When i left joined processes and listening ports osqueryd is unable to retrive some information and its showing this kind of error i have shared below

I0224 11:47:25.384510 31235 config.cpp:505] Normal configuration delay restored
I0224 11:47:26.254513 31244 proc.h:267] Exception iterating process file descriptors: boost::filesystem::directory_iterator::construct: No such file or directory: "/proc/31162/fd"
I0224 11:47:26.254549 31244 process_open_sockets.cpp:76] Results for process_open_sockets might be incomplete. Failed to acquire socket inode to process map for pid 31162: boost::filesystem::directory_iterator::construct: No such file or directory: "/proc/31162/fd"
I0224 11:47:26.254577 31244 process_open_sockets.cpp:105] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET icmp: Could not open socket information from /proc/31162/net/icmp
I0224 11:47:26.254585 31244 process_open_sockets.cpp:113] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET6 icmp: Could not open socket information from /proc/31162/net/icmp6
I0224 11:47:26.254591 31244 process_open_sockets.cpp:105] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET tcp: Could not open socket information from /proc/31162/net/tcp
I0224 11:47:26.254598 31244 process_open_sockets.cpp:113] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET6 tcp: Could not open socket information from /proc/31162/net/tcp6
I0224 11:47:26.254606 31244 process_open_sockets.cpp:105] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET udp: Could not open socket information from /proc/31162/net/udp
I0224 11:47:26.254611 31244 process_open_sockets.cpp:113] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET6 udp: Could not open socket information from /proc/31162/net/udp6
I0224 11:47:26.254619 31244 process_open_sockets.cpp:105] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET udplite: Could not open socket information from /proc/31162/net/udplite
I0224 11:47:26.254626 31244 process_open_sockets.cpp:113] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET6 udplite: Could not open socket information from /proc/31162/net/udplite6
I0224 11:47:26.254634 31244 process_open_sockets.cpp:105] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET raw: Could not open socket information from /proc/31162/net/raw
I0224 11:47:26.254640 31244 process_open_sockets.cpp:113] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_INET6 raw: Could not open socket information from /proc/31162/net/raw6
I0224 11:47:26.254648 31244 process_open_sockets.cpp:121] Results for process_open_sockets might be incomplete. Failed to acquire basic socket information for AF_UNIX: Could not open socket information from /proc/31162/net/unix

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions