Not getting callback for Osquery Packs in osquery extension

75 views Asked by At

I have written one Osquery extension in Go-Lang in that I am registering logger and config plugin. Creating runtime config.

Flages :-

--disable_extensions=false 
 --disable_events=false
 --events_expiry=1 
 --events_optimize=true 
 --events_max=500000 
 --logger_plugin=testlogger 
--config_plugin=testconfig
 --extensions_timeout=600 
 --extensions_interval=5 
 --extensions_require=testextmgr
 --database_path="C:\Program Files\Test\testosqueryd.db" 
 --extensions_socket="\\.\pipe\testosquery.em"

below is my runtime config:-

{
    "packs": {
        "windows-attacks": "C:\\Program Files\\osquery\\packs\\windows-attacks.conf"
    }  
}

Below are my logger and config function.

func LogString(ctx context.Context, typ logger.LogType, logText string) error {
        fmt.Println(logText)
        gCnt = gCnt + 1
        return nil
    }
    
    func ConfigCallback(ctx context.Context) (map[string]string, error) {
        return map[string]string{
            "config": configSchedule_ntfs_journal_events,
        }, nil
    }

Issue:- Now when I run my code, not getting any callback for packs.

Other Tryouts: - Instead of giving runtime conf I checked by giving packs in osquery.conf. There it is giving callback and logs are getting generated. While trying this only change I commented config code and in flags added --config_path="C:\Program Files\osquery\osquery.conf" instead of --config_plugin=testconfig

Can someone help here what is going wrong?

0

There are 0 answers