{"action":"opened","issue":{"url":"https://api.github.com/repos/facebook/osquery/issues/1626","labels_url":"https://api.github.com/repos/facebook/osquery/issues/1626/labels{/name}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/1626/comments","events_url":"https://api.github.com/repos/facebook/osquery/issues/1626/events","html_url":"https://github.com/facebook/osquery/issues/1626","id":114770682,"number":1626,"title":"Failing to open RocksDB on debian wheezy","user":{"login":"ekitaii","id":15624157,"avatar_url":"https://avatars.githubusercontent.com/u/15624157?v=3","gravatar_id":"","url":"https://api.github.com/users/ekitaii","html_url":"https://github.com/ekitaii","followers_url":"https://api.github.com/users/ekitaii/followers","following_url":"https://api.github.com/users/ekitaii/following{/other_user}","gists_url":"https://api.github.com/users/ekitaii/gists{/gist_id}","starred_url":"https://api.github.com/users/ekitaii/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ekitaii/subscriptions","organizations_url":"https://api.github.com/users/ekitaii/orgs","repos_url":"https://api.github.com/users/ekitaii/repos","events_url":"https://api.github.com/users/ekitaii/events{/privacy}","received_events_url":"https://api.github.com/users/ekitaii/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-11-03T08:55:46Z","updated_at":"2015-11-03T08:55:46Z","closed_at":null,"body":"I'm attempting to build the latest osquery on debian wheezy. Since automake on wheezy was too old, I Installed automake-1.15 and its dependencies from debian sid to get automake >= 1.13. At this point I'd already run `make deps` and so all the dependencies had been acquired. The actual run follows:\r\n```\r\n$ git describe --tags HEAD\r\n1.5.3-112-g7b270af\r\n$ make deps\r\n./tools/provision.sh build build/wheezy\r\n[+] detected debian (wheezy)\r\nHit http://debian.saltstack.com wheezy-saltstack Release.gpg\r\nHit http://security.debian.org wheezy/updates Release.gpg\r\nHit http://ftp.us.debian.org wheezy Release.gpg\r\nHit http://debian.saltstack.com wheezy-saltstack Release\r\nHit http://security.debian.org wheezy/updates Release\r\nHit http://debian.saltstack.com wheezy-saltstack/main amd64 Packages\r\nHit http://ftp.us.debian.org wheezy-updates Release.gpg\r\nHit http://security.debian.org wheezy/updates/main Sources\r\nHit http://security.debian.org wheezy/updates/contrib Sources\r\nHit http://ftp.us.debian.org wheezy Release\r\nHit http://security.debian.org wheezy/updates/main amd64 Packages\r\nHit http://ftp.us.debian.org wheezy-updates Release\r\nHit http://llvm.org llvm-toolchain-wheezy-3.4-binaries Release.gpg\r\nHit http://security.debian.org wheezy/updates/contrib amd64 Packages\r\nHit http://ftp.us.debian.org wheezy/main Sources\r\nHit http://security.debian.org wheezy/updates/contrib Translation-en\r\nHit http://llvm.org llvm-toolchain-wheezy-3.4-binaries Release\r\nHit http://security.debian.org wheezy/updates/main Translation-en\r\nHit http://ftp.us.debian.org wheezy/main amd64 Packages\r\nHit http://llvm.org llvm-toolchain-wheezy-3.4-binaries/main amd64 Packages\r\nHit http://ftp.us.debian.org wheezy/main Translation-en\r\nHit http://ftp.us.debian.org wheezy-updates/main Sources\r\nHit http://ftp.us.debian.org wheezy-updates/contrib Sources\r\nHit http://ftp.us.debian.org wheezy-updates/main amd64 Packages/DiffIndex\r\nHit http://ftp.us.debian.org wheezy-updates/contrib amd64 Packages\r\nIgn http://debian.saltstack.com wheezy-saltstack/main Translation-en_US\r\nHit http://ftp.us.debian.org wheezy-updates/contrib Translation-en\r\nIgn http://debian.saltstack.com wheezy-saltstack/main Translation-en\r\nHit http://ftp.us.debian.org wheezy-updates/main Translation-en\r\nIgn http://llvm.org llvm-toolchain-wheezy-3.4-binaries/main Translation-en_US\r\nIgn http://llvm.org llvm-toolchain-wheezy-3.4-binaries/main Translation-en\r\nHit http://httpredir.debian.org wheezy-backports Release.gpg\r\nHit http://httpredir.debian.org wheezy-backports Release\r\nHit http://httpredir.debian.org wheezy-backports/main amd64 Packages/DiffIndex\r\nHit http://httpredir.debian.org wheezy-backports/main Translation-en/DiffIndex\r\nReading package lists...\r\nReading package lists...\r\nBuilding dependency tree...\r\nReading state information...\r\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\r\n[+] git-core is already installed. skipping.\r\n[+] wget is already installed. skipping.\r\n[+] unzip is already installed. skipping.\r\n[+] build-essential is already installed. skipping.\r\n[+] libtool is already installed. skipping.\r\n[+] autoconf is already installed. skipping.\r\n[+] pkg-config is already installed. skipping.\r\n[+] bison is already installed. skipping.\r\n[+] flex is already installed. skipping.\r\n[+] devscripts is already installed. skipping.\r\n[+] debhelper is already installed. skipping.\r\n[+] python-pip is already installed. skipping.\r\n[+] python-dev is already installed. skipping.\r\n[+] ruby-dev is already installed. skipping.\r\n[+] gcc is already installed. skipping.\r\n[+] doxygen is already installed. skipping.\r\n[+] autopoint is already installed. skipping.\r\n[+] libssl-dev is already installed. skipping.\r\n[+] liblzma-dev is already installed. skipping.\r\n[+] uuid-dev is already installed. skipping.\r\n[+] libpopt-dev is already installed. skipping.\r\n[+] libdpkg-dev is already installed. skipping.\r\n[+] libudev-dev is already installed. skipping.\r\n[+] libblkid-dev is already installed. skipping.\r\n[+] libbz2-dev is already installed. skipping.\r\n[+] libreadline-dev is already installed. skipping.\r\n[+] g++-multilib is already installed. skipping.\r\n[+] iptables-dev is already installed. skipping.\r\n[+] libsnappy-dev is already installed. skipping.\r\n[+] libgflags-dev is already installed. skipping.\r\n[+] libaudit-dev is already installed. skipping.\r\n[+] libmagic-dev is already installed. skipping.\r\n/usr/include/c++/4.7 /tmp/osquery-provisioning\r\n[+] /usr/include/c++/4.7/condition_variable already patched: found a .orig\r\n/tmp/osquery-provisioning\r\n[+] cmake is already installed. skipping provision.\r\n[+] boost is already installed. skipping provision.\r\n[+] benchmark is already installed. skipping provision.\r\n[+] thrift is already installed. skipping provision.\r\n[+] rocksdb is already installed. skipping provision.\r\n[+] yara is already installed. skipping provision.\r\n[+] cppnetlib is already installed. skipping provision.\r\n[+] gflags is already installed. skipping provision.\r\n[+] installing libgcrypt-dev\r\nReading package lists...\r\nBuilding dependency tree...\r\nReading state information...\r\nlibgcrypt11-dev is already the newest version.\r\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\r\n[+] libdevmapper-dev is already installed. skipping.\r\n[+] libcryptsetup-dev is already installed. skipping.\r\nRequirement already satisfied (use --upgrade to upgrade): Jinja2 in /usr/local/lib/python2.7/dist-packages (from -r requirements.txt (line 1))\r\nRequirement already satisfied (use --upgrade to upgrade): psutil in /usr/local/lib/python2.7/dist-packages (from -r requirements.txt (line 2))\r\nRequirement already satisfied (use --upgrade to upgrade): argparse in /usr/lib/python2.7 (from -r requirements.txt (line 3))\r\nRequirement already satisfied (use --upgrade to upgrade): pexpect in /usr/local/lib/python2.7/dist-packages (from -r requirements.txt (line 6))\r\nRequirement already satisfied (use --upgrade to upgrade): thrift in /usr/local/lib/python2.7/dist-packages (from -r requirements.txt (line 7))\r\nRequirement already satisfied (use --upgrade to upgrade): flaky in /usr/local/lib/python2.7/dist-packages (from -r requirements.txt (line 8))\r\nRequirement already satisfied (use --upgrade to upgrade): MarkupSafe in /usr/lib/python2.7/dist-packages (from Jinja2->-r requirements.txt (line 1))\r\nRequirement already satisfied (use --upgrade to upgrade): ptyprocess>=0.5 in /usr/local/lib/python2.7/dist-packages (from pexpect->-r requirements.txt (line 6))\r\nCleaning up...\r\nHEAD is now at 7b270af Merge pull request #1623 from theopolis/simple_errors\r\nSubmodule 'third-party' (https://github.com/osquery/third-party.git) registered for path 'third-party'\r\nCloning into 'third-party'...\r\nSubmodule path 'third-party': checked out 'f5a91963fab9e7b1481c58d55671390e12ce7757'\r\n```\r\n```make``` seems to work alright.\r\n```\r\n$ make\r\ncd build/wheezy && cmake ../../ && \\\r\n\t\tCTEST_OUTPUT_ON_FAILURE=1 make --no-print-directory \r\n-- The C compiler identification is Clang 3.4.0\r\n-- The CXX compiler identification is Clang 3.4.0\r\n-- Check for working C compiler: /usr/bin/clang\r\n-- Check for working C compiler: /usr/bin/clang -- works\r\n-- Detecting C compiler ABI info\r\n-- Detecting C compiler ABI info - done\r\n-- Detecting C compile features\r\n-- Detecting C compile features - done\r\n-- Check for working CXX compiler: /usr/bin/clang++\r\n-- Check for working CXX compiler: /usr/bin/clang++ -- works\r\n-- Detecting CXX compiler ABI info\r\n-- Detecting CXX compiler ABI info - done\r\n-- Detecting CXX compile features\r\n-- Detecting CXX compile features - done\r\n-- Found BZip2: /usr/lib/x86_64-linux-gnu/libbz2.so (found version \"1.0.6\") \r\n-- Looking for BZ2_bzCompressInit in /usr/lib/x86_64-linux-gnu/libbz2.so\r\n-- Looking for BZ2_bzCompressInit in /usr/lib/x86_64-linux-gnu/libbz2.so - found\r\n-- Found OpenSSL: /usr/lib/x86_64-linux-gnu/libssl.so;/usr/lib/x86_64-linux-gnu/libcrypto.so (found version \"1.0.1e\") \r\n-- Looking for SSLv3_client_method in /usr/lib/x86_64-linux-gnu/libssl.so\r\n-- Looking for SSLv3_client_method in /usr/lib/x86_64-linux-gnu/libssl.so - found\r\n-- Looking for TLSv1_2_client_method in /usr/lib/x86_64-linux-gnu/libssl.so\r\n-- Looking for TLSv1_2_client_method in /usr/lib/x86_64-linux-gnu/libssl.so - found\r\n-- Looking for TLSv1_1_client_method in /usr/lib/x86_64-linux-gnu/libssl.so\r\n-- Looking for TLSv1_1_client_method in /usr/lib/x86_64-linux-gnu/libssl.so - found\r\n-- Looking for TLSv1_client_method in /usr/lib/x86_64-linux-gnu/libssl.so\r\n-- Looking for TLSv1_client_method in /usr/lib/x86_64-linux-gnu/libssl.so - found\r\n-- Found PythonInterp: /usr/bin/python (found version \"2.7.3\") \r\n-- Looking for include file pthread.h\r\n-- Looking for include file pthread.h - found\r\n-- Looking for pthread_create\r\n-- Looking for pthread_create - not found\r\n-- Looking for pthread_create in pthreads\r\n-- Looking for pthread_create in pthreads - not found\r\n-- Looking for pthread_create in pthread\r\n-- Looking for pthread_create in pthread - found\r\n-- Found Threads: TRUE  \r\n-- Found Doxygen: /usr/bin/doxygen (found version \"1.8.1.2\") \r\n-- Configuring done\r\n-- Generating done\r\n-- Build files have been written to: /home/vegeta/git/osquery/build/wheezy\r\nScanning dependencies of target libglog\r\n[  1%] Creating directories for 'libglog'\r\n[  1%] No download step for 'libglog'\r\n[  2%] No patch step for 'libglog'\r\n[  2%] No update step for 'libglog'\r\n[  2%] Performing configure step for 'libglog'\r\n-- libglog configure command succeeded.  See also /home/vegeta/git/osquery/build/wheezy/libglog-prefix/src/libglog-stamp/libglog-configure-*.log\r\n[  3%] Performing build step for 'libglog'\r\n-- libglog build command succeeded.  See also /home/vegeta/git/osquery/build/wheezy/libglog-prefix/src/libglog-stamp/libglog-build-*.log\r\n[  3%] Performing install step for 'libglog'\r\n-- libglog install command succeeded.  See also /home/vegeta/git/osquery/build/wheezy/libglog-prefix/src/libglog-stamp/libglog-install-*.log\r\n[  4%] Completed 'libglog'\r\n[  4%] Built target libglog\r\nScanning dependencies of target gtest\r\n[  4%] Building CXX object third-party/gtest-1.7.0/CMakeFiles/gtest.dir/src/gtest-all.cc.o\r\nLinking CXX static library libgtest.a\r\n[  4%] Built target gtest\r\nScanning dependencies of target gtest_main\r\n[  4%] Building CXX object third-party/gtest-1.7.0/CMakeFiles/gtest_main.dir/src/gtest_main.cc.o\r\nLinking CXX static library libgtest_main.a\r\n[  4%] Built target gtest_main\r\nScanning dependencies of target osquery_sqlite\r\n[  4%] Building C object third-party/sqlite3/CMakeFiles/osquery_sqlite.dir/sqlite3.c.o\r\n[  4%] Built target osquery_sqlite\r\n[  5%] Generating ../../generated/gen-cpp/Extension.cpp, ../../generated/gen-cpp/Extension.h, ../../generated/gen-cpp/ExtensionManager.cpp, ../../generated/gen-cpp/ExtensionManager.h, ../../generated/gen-cpp/osquery_types.cpp, ../../generated/gen-cpp/osquery_types.h\r\nScanning dependencies of target osquery_extensions\r\n[  5%] Building CXX object osquery/extensions/CMakeFiles/osquery_extensions.dir/__/__/generated/gen-cpp/Extension.cpp.o\r\n[  6%] Building CXX object osquery/extensions/CMakeFiles/osquery_extensions.dir/__/__/generated/gen-cpp/ExtensionManager.cpp.o\r\n[  6%] Building CXX object osquery/extensions/CMakeFiles/osquery_extensions.dir/__/__/generated/gen-cpp/osquery_types.cpp.o\r\n[  6%] Building CXX object osquery/extensions/CMakeFiles/osquery_extensions.dir/extensions.cpp.o\r\n[  7%] Building CXX object osquery/extensions/CMakeFiles/osquery_extensions.dir/interface.cpp.o\r\n[  7%] Built target osquery_extensions\r\n[  8%] Generating ../generated/tables_additional/iptables.cpp\r\n[  9%] Generating ../generated/tables_additional/example.cpp\r\n\u001B[1;31m Blacklisting generated /home/vegeta/git/osquery/build/wheezy/generated/tables_additional/example.cpp \u001B[0m\r\n[  9%] Generating ../generated/tables_additional/interface_addresses.cpp\r\n[  9%] Generating ../generated/tables_additional/chrome_extensions.cpp\r\n[ 10%] Generating ../generated/tables_additional/suid_bin.cpp\r\n[ 10%] Generating ../generated/tables_additional/opera_extensions.cpp\r\n[ 11%] Generating ../generated/tables_additional/last.cpp\r\n[ 11%] Generating ../generated/tables_additional/etc_hosts.cpp\r\n[ 11%] Generating ../generated/tables_additional/groups.cpp\r\n[ 12%] Generating ../generated/tables_additional/user_groups.cpp\r\n[ 12%] Generating ../generated/tables_additional/block_devices.cpp\r\n[ 13%] Generating ../generated/tables_additional/usb_devices.cpp\r\n[ 13%] Generating ../generated/tables_additional/uptime.cpp\r\n[ 13%] Generating ../generated/tables_additional/etc_services.cpp\r\n[ 14%] Generating ../generated/tables_additional/os_version.cpp\r\n[ 14%] Generating ../generated/tables_additional/process_open_files.cpp\r\n[ 15%] Generating ../generated/tables_additional/crontab.cpp\r\n[ 15%] Generating ../generated/tables_additional/process_memory_map.cpp\r\n[ 15%] Generating ../generated/tables_additional/passwd_changes.cpp\r\n[ 16%] Generating ../generated/tables_additional/system_controls.cpp\r\n[ 16%] Generating ../generated/tables_additional/process_envs.cpp\r\n[ 17%] Generating ../generated/tables_additional/hardware_events.cpp\r\n[ 17%] Generating ../generated/tables_additional/users.cpp\r\n[ 18%] Generating ../generated/tables_additional/arp_cache.cpp\r\n[ 18%] Generating ../generated/tables_additional/mounts.cpp\r\n[ 18%] Generating ../generated/tables_additional/cpuid.cpp\r\n[ 19%] Generating ../generated/tables_additional/interface_details.cpp\r\n[ 19%] Generating ../generated/tables_additional/file_events.cpp\r\n[ 20%] Generating ../generated/tables_additional/firefox_addons.cpp\r\n[ 20%] Generating ../generated/tables_additional/magic.cpp\r\n[ 20%] Generating ../generated/tables_additional/process_events.cpp\r\n[ 21%] Generating ../generated/tables_additional/processes.cpp\r\n[ 21%] Generating ../generated/tables_additional/routes.cpp\r\n[ 22%] Generating ../generated/tables_additional/etc_protocols.cpp\r\n[ 22%] Generating ../generated/tables_additional/smbios_tables.cpp\r\n[ 22%] Generating ../generated/tables_additional/yara.cpp\r\n[ 23%] Generating ../generated/tables_additional/pci_devices.cpp\r\n[ 23%] Generating ../generated/tables_additional/disk_encryption.cpp\r\n[ 24%] Generating ../generated/tables_additional/logged_in_users.cpp\r\n[ 24%] Generating ../generated/tables_additional/kernel_info.cpp\r\n[ 24%] Generating ../generated/tables_additional/process_open_sockets.cpp\r\n[ 25%] Generating ../generated/tables_additional/listening_ports.cpp\r\n[ 25%] Generating ../generated/tables_additional/acpi_tables.cpp\r\n[ 26%] Generating ../generated/tables_additional/shell_history.cpp\r\n[ 26%] Generating ../generated/tables_additional/yara_events.cpp\r\n[ 26%] Generating ../generated/tables_additional/memory_map.cpp\r\n[ 27%] Generating ../generated/tables_additional/kernel_integrity.cpp\r\n[ 27%] Generating ../generated/tables_additional/socket_events.cpp\r\n[ 28%] Generating ../generated/tables_additional/shared_memory.cpp\r\n[ 28%] Generating ../generated/tables_additional/kernel_modules.cpp\r\n[ 28%] Generating ../generated/tables_additional/msr.cpp\r\n[ 28%] Generating ../generated/additional_amalgamation.cpp\r\nScanning dependencies of target osquery_additional_amalgamation\r\n[ 28%] Building CXX object osquery/CMakeFiles/osquery_additional_amalgamation.dir/__/generated/additional_amalgamation.cpp.o\r\n[ 28%] Built target osquery_additional_amalgamation\r\nScanning dependencies of target osquery_config_plugins\r\n[ 28%] Building CXX object osquery/config/CMakeFiles/osquery_config_plugins.dir/plugins/filesystem.cpp.o\r\n[ 29%] Building CXX object osquery/config/CMakeFiles/osquery_config_plugins.dir/plugins/tls.cpp.o\r\n[ 29%] Building CXX object osquery/config/CMakeFiles/osquery_config_plugins.dir/update.cpp.o\r\n[ 29%] Built target osquery_config_plugins\r\nScanning dependencies of target osquery_devtools\r\n[ 29%] Building CXX object osquery/devtools/CMakeFiles/osquery_devtools.dir/printer.cpp.o\r\n[ 29%] Built target osquery_devtools\r\nScanning dependencies of target osquery_dispatcher_runners\r\n[ 29%] Building CXX object osquery/dispatcher/CMakeFiles/osquery_dispatcher_runners.dir/scheduler.cpp.o\r\n[ 29%] Building CXX object osquery/dispatcher/CMakeFiles/osquery_dispatcher_runners.dir/distributed.cpp.o\r\n[ 29%] Built target osquery_dispatcher_runners\r\nScanning dependencies of target osquery_distributed_plugins\r\n[ 29%] Building CXX object osquery/distributed/CMakeFiles/osquery_distributed_plugins.dir/plugins/tls.cpp.o\r\n[ 29%] Built target osquery_distributed_plugins\r\nScanning dependencies of target osquery_events_linux\r\n[ 29%] Building CXX object osquery/events/CMakeFiles/osquery_events_linux.dir/linux/udev.cpp.o\r\n[ 30%] Building CXX object osquery/events/CMakeFiles/osquery_events_linux.dir/linux/kernel_util.cpp.o\r\n[ 30%] Building CXX object osquery/events/CMakeFiles/osquery_events_linux.dir/linux/audit.cpp.o\r\n[ 30%] Building CXX object osquery/events/CMakeFiles/osquery_events_linux.dir/linux/inotify.cpp.o\r\n[ 30%] Built target osquery_events_linux\r\nScanning dependencies of target osquery_events_kernel\r\n[ 30%] Building CXX object osquery/events/CMakeFiles/osquery_events_kernel.dir/kernel.cpp.o\r\n[ 31%] Building CXX object osquery/events/CMakeFiles/osquery_events_kernel.dir/kernel/circular_queue_user.cpp.o\r\n[ 31%] Built target osquery_events_kernel\r\nScanning dependencies of target osquery_logger_plugins\r\n[ 31%] Building CXX object osquery/logger/CMakeFiles/osquery_logger_plugins.dir/plugins/filesystem.cpp.o\r\n[ 32%] Building CXX object osquery/logger/CMakeFiles/osquery_logger_plugins.dir/plugins/tls.cpp.o\r\n[ 32%] Building CXX object osquery/logger/CMakeFiles/osquery_logger_plugins.dir/plugins/syslog.cpp.o\r\n[ 32%] Built target osquery_logger_plugins\r\nScanning dependencies of target osquery_remote\r\n[ 32%] Building CXX object osquery/remote/CMakeFiles/osquery_remote.dir/enroll/enroll.cpp.o\r\n[ 32%] Building CXX object osquery/remote/CMakeFiles/osquery_remote.dir/serializers/json.cpp.o\r\n[ 34%] Building CXX object osquery/remote/CMakeFiles/osquery_remote.dir/transports/tls.cpp.o\r\n[ 34%] Built target osquery_remote\r\nScanning dependencies of target osquery_enrollment_plugins\r\n[ 35%] Building CXX object osquery/remote/CMakeFiles/osquery_enrollment_plugins.dir/enroll/plugins/tls.cpp.o\r\n[ 35%] Built target osquery_enrollment_plugins\r\nScanning dependencies of target osquery_sql_internal\r\n[ 36%] Building CXX object osquery/sql/CMakeFiles/osquery_sql_internal.dir/sqlite_util.cpp.o\r\n[ 36%] Building CXX object osquery/sql/CMakeFiles/osquery_sql_internal.dir/virtual_table.cpp.o\r\n[ 36%] Built target osquery_sql_internal\r\nScanning dependencies of target osquery_tables\r\n[ 37%] Building CXX object osquery/tables/CMakeFiles/osquery_tables.dir/applications/browser_firefox.cpp.o\r\n[ 37%] Building CXX object osquery/tables/CMakeFiles/osquery_tables.dir/applications/browser_utils.cpp.o\r\n[ 38%] Building CXX object osquery/tables/CMakeFiles/osquery_tables.dir/applications/browser_opera.cpp.o\r\n[ 38%] Building CXX object osquery/tables/CMakeFiles/osquery_tables.dir/applications/browser_chrome.cpp.o\r\n[ 39%] Building CXX object osquery/tables/CMakeFiles/osquery_tables.dir/system/shell_history.cpp.o\r\n[ 39%] Building CXX object osquery/tables/CMakeFiles/osquery_tables.dir/system/system_controls.cpp.o\r\n[ 39%] Building CXX object osquery/tables/CMakeFiles/osquery_tables.dir/system/suid_bin.cpp.o\r\n[ 40%] Building CXX object osquery/tables/CMakeFiles/osquery_tables.dir/system/magic.cpp.o\r\n[ 40%] Building CXX object osquery/tables/CMakeFiles/osquery_tables.dir/system/last.cpp.o\r\n[ 41%] Building CXX object osquery/tables/CMakeFiles/osquery_tables.dir/system/logged_in_users.cpp.o\r\n[ 41%] Building CXX object osquery/tables/CMakeFiles/osquery_tables.dir/system/crontab.cpp.o\r\n[ 41%] Building CXX object osquery/tables/CMakeFiles/osquery_tables.dir/system/smbios_utils.cpp.o\r\n[ 42%] Building CXX object osquery/tables/CMakeFiles/osquery_tables.dir/system/uptime.cpp.o\r\n[ 42%] Building CXX object osquery/tables/CMakeFiles/osquery_tables.dir/system/cpuid.cpp.o\r\n[ 43%] Building CXX object osquery/tables/CMakeFiles/osquery_tables.dir/networking/etc_services.cpp.o\r\n[ 43%] Building CXX object osquery/tables/CMakeFiles/osquery_tables.dir/networking/listening_ports.cpp.o\r\n[ 43%] Building CXX object osquery/tables/CMakeFiles/osquery_tables.dir/networking/etc_protocols.cpp.o\r\n[ 44%] Building CXX object osquery/tables/CMakeFiles/osquery_tables.dir/networking/etc_hosts.cpp.o\r\n[ 44%] Building CXX object osquery/tables/CMakeFiles/osquery_tables.dir/networking/utils.cpp.o\r\n[ 45%] Building CXX object osquery/tables/CMakeFiles/osquery_tables.dir/networking/interfaces.cpp.o\r\n[ 45%] Building CXX object osquery/tables/CMakeFiles/osquery_tables.dir/events/file_access_events.cpp.o\r\n[ 45%] Building CXX object osquery/tables/CMakeFiles/osquery_tables.dir/events/yara_events.cpp.o\r\n[ 45%] Built target osquery_tables\r\nScanning dependencies of target osquery_tables_linux\r\n[ 46%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/networking/linux/arp_cache.cpp.o\r\n[ 46%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/networking/linux/iptables.cpp.o\r\n[ 47%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/networking/linux/routes.cpp.o\r\n[ 47%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/networking/linux/process_open_sockets.cpp.o\r\n[ 47%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/events/linux/file_events.cpp.o\r\n[ 48%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/events/linux/process_events.cpp.o\r\n[ 48%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/events/linux/passwd_changes.cpp.o\r\n[ 49%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/events/linux/hardware_events.cpp.o\r\n[ 49%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/events/linux/socket_events.cpp.o\r\n[ 49%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/system/linux/os_version.cpp.o\r\n[ 50%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/system/linux/kernel_integrity.cpp.o\r\n[ 50%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/system/linux/process_open_files.cpp.o\r\n[ 51%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/system/linux/disk_encryption.cpp.o\r\n[ 51%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/system/linux/shared_memory.cpp.o\r\n[ 51%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/system/linux/processes.cpp.o\r\n[ 52%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/system/linux/kernel_info.cpp.o\r\n[ 52%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/system/linux/kernel_modules.cpp.o\r\n[ 53%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/system/linux/users.cpp.o\r\n[ 53%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/system/linux/user_groups.cpp.o\r\n[ 53%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/system/linux/pci_devices.cpp.o\r\n[ 54%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/system/linux/block_devices.cpp.o\r\n[ 54%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/system/linux/memory_map.cpp.o\r\n[ 55%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/system/linux/usb_devices.cpp.o\r\n[ 55%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/system/linux/model_specific_register.cpp.o\r\n[ 56%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/system/linux/smbios_tables.cpp.o\r\n[ 56%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/system/linux/groups.cpp.o\r\n[ 56%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/system/linux/mounts.cpp.o\r\n[ 57%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/system/linux/sysctl_utils.cpp.o\r\n[ 57%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_linux.dir/system/linux/acpi_tables.cpp.o\r\n[ 57%] Built target osquery_tables_linux\r\nScanning dependencies of target osquery_utils\r\n[ 57%] Building CXX object osquery/tables/CMakeFiles/osquery_utils.dir/other/yara_utils.cpp.o\r\n[ 57%] Building CXX object osquery/tables/CMakeFiles/osquery_utils.dir/other/yara.cpp.o\r\n[ 57%] Built target osquery_utils\r\nScanning dependencies of target libosquery_additional\r\nLinking CXX static library libosquery_additional.a\r\n[ 57%] Built target libosquery_additional\r\n[ 57%] Generating ../generated/tables_utils/file.cpp\r\n[ 57%] Generating ../generated/tables_utils/osquery_packs.cpp\r\n[ 58%] Generating ../generated/tables_utils/hash.cpp\r\n[ 58%] Generating ../generated/tables_utils/time.cpp\r\n[ 59%] Generating ../generated/tables_utils/osquery_schedule.cpp\r\n[ 59%] Generating ../generated/tables_utils/osquery_extensions.cpp\r\n[ 59%] Generating ../generated/tables_utils/osquery_info.cpp\r\n[ 60%] Generating ../generated/tables_utils/osquery_flags.cpp\r\n[ 60%] Generating ../generated/tables_utils/osquery_registry.cpp\r\n[ 61%] Generating ../generated/tables_utils/osquery_events.cpp\r\n[ 61%] Generating ../generated/utils_amalgamation.cpp\r\nScanning dependencies of target osquery_amalgamation\r\n[ 61%] Building CXX object osquery/CMakeFiles/osquery_amalgamation.dir/__/generated/utils_amalgamation.cpp.o\r\n[ 61%] Built target osquery_amalgamation\r\nScanning dependencies of target osquery_config\r\n[ 61%] Building CXX object osquery/config/CMakeFiles/osquery_config.dir/config.cpp.o\r\n[ 62%] Building CXX object osquery/config/CMakeFiles/osquery_config.dir/packs.cpp.o\r\n[ 62%] Built target osquery_config\r\nScanning dependencies of target osquery_config_parsers\r\n[ 62%] Building CXX object osquery/config/CMakeFiles/osquery_config_parsers.dir/parsers/events.cpp.o\r\n[ 63%] Building CXX object osquery/config/CMakeFiles/osquery_config_parsers.dir/parsers/file_paths.cpp.o\r\n[ 63%] Building CXX object osquery/config/CMakeFiles/osquery_config_parsers.dir/parsers/options.cpp.o\r\n[ 63%] Built target osquery_config_parsers\r\nScanning dependencies of target osquery_core\r\n[ 64%] Building CXX object osquery/core/CMakeFiles/osquery_core.dir/conversions.cpp.o\r\n[ 64%] Building CXX object osquery/core/CMakeFiles/osquery_core.dir/init.cpp.o\r\n[ 64%] Building CXX object osquery/core/CMakeFiles/osquery_core.dir/system.cpp.o\r\n[ 65%] Building CXX object osquery/core/CMakeFiles/osquery_core.dir/tables.cpp.o\r\n[ 65%] Building CXX object osquery/core/CMakeFiles/osquery_core.dir/text.cpp.o\r\n[ 67%] Building CXX object osquery/core/CMakeFiles/osquery_core.dir/flags.cpp.o\r\n[ 67%] Building CXX object osquery/core/CMakeFiles/osquery_core.dir/hash.cpp.o\r\n[ 67%] Building CXX object osquery/core/CMakeFiles/osquery_core.dir/watcher.cpp.o\r\n[ 67%] Built target osquery_core\r\nScanning dependencies of target osquery_database\r\n[ 68%] Building CXX object osquery/database/CMakeFiles/osquery_database.dir/database.cpp.o\r\n[ 68%] Built target osquery_database\r\nScanning dependencies of target osquery_database_internal\r\n[ 68%] Building CXX object osquery/database/CMakeFiles/osquery_database_internal.dir/db_handle.cpp.o\r\n[ 69%] Building CXX object osquery/database/CMakeFiles/osquery_database_internal.dir/query.cpp.o\r\n[ 69%] Built target osquery_database_internal\r\nScanning dependencies of target osquery_dispatcher\r\n[ 70%] Building CXX object osquery/dispatcher/CMakeFiles/osquery_dispatcher.dir/dispatcher.cpp.o\r\n[ 70%] Built target osquery_dispatcher\r\nScanning dependencies of target osquery_distributed\r\n[ 71%] Building CXX object osquery/distributed/CMakeFiles/osquery_distributed.dir/distributed.cpp.o\r\n[ 71%] Built target osquery_distributed\r\nScanning dependencies of target osquery_events\r\n[ 71%] Building CXX object osquery/events/CMakeFiles/osquery_events.dir/events.cpp.o\r\n[ 71%] Built target osquery_events\r\nScanning dependencies of target osquery_filesystem_linux\r\n[ 72%] Building CXX object osquery/filesystem/CMakeFiles/osquery_filesystem_linux.dir/linux/mem.cpp.o\r\n[ 72%] Building CXX object osquery/filesystem/CMakeFiles/osquery_filesystem_linux.dir/linux/proc.cpp.o\r\n[ 72%] Built target osquery_filesystem_linux\r\nScanning dependencies of target osquery_filesystem\r\n[ 72%] Building CXX object osquery/filesystem/CMakeFiles/osquery_filesystem.dir/filesystem.cpp.o\r\n[ 72%] Built target osquery_filesystem\r\nScanning dependencies of target osquery_logger\r\n[ 72%] Building CXX object osquery/logger/CMakeFiles/osquery_logger.dir/logger.cpp.o\r\n[ 72%] Built target osquery_logger\r\nScanning dependencies of target osquery_registry\r\n[ 73%] Building CXX object osquery/registry/CMakeFiles/osquery_registry.dir/registry.cpp.o\r\n[ 73%] Built target osquery_registry\r\nScanning dependencies of target osquery_sql\r\n[ 73%] Building CXX object osquery/sql/CMakeFiles/osquery_sql.dir/sql.cpp.o\r\n[ 73%] Built target osquery_sql\r\nScanning dependencies of target osquery_tables_utility\r\n[ 73%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_utility.dir/utility/hash.cpp.o\r\n[ 74%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_utility.dir/utility/osquery.cpp.o\r\n[ 74%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_utility.dir/utility/file.cpp.o\r\n[ 74%] Building CXX object osquery/tables/CMakeFiles/osquery_tables_utility.dir/utility/time.cpp.o\r\n[ 74%] Built target osquery_tables_utility\r\nScanning dependencies of target libosquery\r\n[ 74%] Building CXX object osquery/CMakeFiles/libosquery.dir/main/lib.cpp.o\r\nLinking CXX static library libosquery.a\r\n[ 74%] Built target libosquery\r\nScanning dependencies of target daemon\r\n[ 74%] Building CXX object osquery/CMakeFiles/daemon.dir/main/daemon.cpp.o\r\nLinking CXX executable osqueryd\r\n[ 74%] Built target daemon\r\nScanning dependencies of target example_extension\r\n[ 75%] Building CXX object osquery/CMakeFiles/example_extension.dir/examples/example_extension.cpp.o\r\nLinking CXX executable example_extension.ext\r\n[ 75%] Built target example_extension\r\nScanning dependencies of target libosquery_testing\r\n[ 75%] Building CXX object osquery/CMakeFiles/libosquery_testing.dir/core/test_util.cpp.o\r\nLinking CXX static library libosquery_testing.a\r\n[ 75%] Built target libosquery_testing\r\nScanning dependencies of target modexample\r\n[ 76%] Building CXX object osquery/CMakeFiles/modexample.dir/examples/example_module.cpp.o\r\nLinking CXX shared library libmodexample.so\r\n[ 76%] Built target modexample\r\nScanning dependencies of target osquery_additional_tests\r\n[ 77%] Building CXX object osquery/CMakeFiles/osquery_additional_tests.dir/main/tests.cpp.o\r\n[ 77%] Building CXX object osquery/CMakeFiles/osquery_additional_tests.dir/config/tests/packs_tests.cpp.o\r\n[ 77%] Building CXX object osquery/CMakeFiles/osquery_additional_tests.dir/config/parsers/tests/options_tests.cpp.o\r\n[ 78%] Building CXX object osquery/CMakeFiles/osquery_additional_tests.dir/config/parsers/tests/events_tests.cpp.o\r\n[ 78%] Building CXX object osquery/CMakeFiles/osquery_additional_tests.dir/config/parsers/tests/file_paths_tests.cpp.o\r\n[ 79%] Building CXX object osquery/CMakeFiles/osquery_additional_tests.dir/devtools/tests/printer_tests.cpp.o\r\n[ 79%] Building CXX object osquery/CMakeFiles/osquery_additional_tests.dir/distributed/tests/distributed_tests.cpp.o\r\n[ 79%] Building CXX object osquery/CMakeFiles/osquery_additional_tests.dir/events/linux/tests/audit_tests.cpp.o\r\n[ 80%] Building CXX object osquery/CMakeFiles/osquery_additional_tests.dir/events/linux/tests/inotify_tests.cpp.o\r\n[ 80%] Building CXX object osquery/CMakeFiles/osquery_additional_tests.dir/logger/tests/logger_tests.cpp.o\r\n[ 81%] Building CXX object osquery/CMakeFiles/osquery_additional_tests.dir/remote/tests/requests_tests.cpp.o\r\n[ 81%] Building CXX object osquery/CMakeFiles/osquery_additional_tests.dir/remote/enroll/tests/enroll_tests.cpp.o\r\n[ 82%] Building CXX object osquery/CMakeFiles/osquery_additional_tests.dir/remote/serializers/tests/json_serializers_tests.cpp.o\r\n[ 82%] Building CXX object osquery/CMakeFiles/osquery_additional_tests.dir/remote/transports/tests/tls_transports_tests.cpp.o\r\n[ 82%] Building CXX object osquery/CMakeFiles/osquery_additional_tests.dir/sql/tests/sql_tests.cpp.o\r\n[ 83%] Building CXX object osquery/CMakeFiles/osquery_additional_tests.dir/sql/tests/virtual_table_tests.cpp.o\r\n[ 83%] Building CXX object osquery/CMakeFiles/osquery_additional_tests.dir/sql/tests/sqlite_util_tests.cpp.o\r\n[ 84%] Building CXX object osquery/CMakeFiles/osquery_additional_tests.dir/tables/other/tests/yara_tests.cpp.o\r\nLinking CXX executable osquery_additional_tests\r\n[ 84%] Built target osquery_additional_tests\r\nScanning dependencies of target osquery_benchmarks\r\n[ 85%] Building CXX object osquery/CMakeFiles/osquery_benchmarks.dir/main/benchmarks.cpp.o\r\n[ 85%] Building CXX object osquery/CMakeFiles/osquery_benchmarks.dir/database/benchmarks/database_benchmarks.cpp.o\r\n[ 86%] Building CXX object osquery/CMakeFiles/osquery_benchmarks.dir/events/benchmarks/events_benchmarks.cpp.o\r\n[ 86%] Building CXX object osquery/CMakeFiles/osquery_benchmarks.dir/sql/benchmarks/sql_benchmarks.cpp.o\r\nLinking CXX executable osquery_benchmarks\r\n[ 86%] Built target osquery_benchmarks\r\nScanning dependencies of target osquery_kernel_benchmarks\r\n[ 86%] Building CXX object osquery/CMakeFiles/osquery_kernel_benchmarks.dir/main/benchmarks.cpp.o\r\n[ 87%] Building CXX object osquery/CMakeFiles/osquery_kernel_benchmarks.dir/events/kernel/benchmarks/kernel_communication_benchmarks.cpp.o\r\nLinking CXX executable osquery_kernel_benchmarks\r\n[ 87%] Built target osquery_kernel_benchmarks\r\nScanning dependencies of target osquery_kernel_tests\r\n[ 87%] Building CXX object osquery/CMakeFiles/osquery_kernel_tests.dir/main/tests.cpp.o\r\n[ 88%] Building CXX object osquery/CMakeFiles/osquery_kernel_tests.dir/events/kernel/tests/kernel_communication_tests.cpp.o\r\nLinking CXX executable osquery_kernel_tests\r\n[ 88%] Built target osquery_kernel_tests\r\nScanning dependencies of target osquery_library\r\n-- Built libosquery: /home/vegeta/git/osquery/build/wheezy/libosquery.a\r\n[ 88%] Built target osquery_library\r\nScanning dependencies of target osquery_tables_tests\r\n[ 89%] Building CXX object osquery/CMakeFiles/osquery_tables_tests.dir/main/tests.cpp.o\r\n[ 89%] Building CXX object osquery/CMakeFiles/osquery_tables_tests.dir/tables/networking/linux/tests/iptables_tests.cpp.o\r\n[ 89%] Building CXX object osquery/CMakeFiles/osquery_tables_tests.dir/tables/networking/tests/networking_tables_tests.cpp.o\r\n[ 90%] Building CXX object osquery/CMakeFiles/osquery_tables_tests.dir/tables/system/tests/system_tables_tests.cpp.o\r\nLinking CXX executable osquery_tables_tests\r\n[ 90%] Built target osquery_tables_tests\r\nScanning dependencies of target osquery_tests\r\n[ 91%] Building CXX object osquery/CMakeFiles/osquery_tests.dir/main/tests.cpp.o\r\n[ 91%] Building CXX object osquery/CMakeFiles/osquery_tests.dir/config/tests/config_tests.cpp.o\r\n[ 92%] Building CXX object osquery/CMakeFiles/osquery_tests.dir/core/tests/hash_tests.cpp.o\r\n[ 92%] Building CXX object osquery/CMakeFiles/osquery_tests.dir/core/tests/permissions_tests.cpp.o\r\n[ 92%] Building CXX object osquery/CMakeFiles/osquery_tests.dir/core/tests/flags_tests.cpp.o\r\n[ 93%] Building CXX object osquery/CMakeFiles/osquery_tests.dir/core/tests/conversions_tests.cpp.o\r\n[ 93%] Building CXX object osquery/CMakeFiles/osquery_tests.dir/core/tests/status_tests.cpp.o\r\n[ 94%] Building CXX object osquery/CMakeFiles/osquery_tests.dir/core/tests/tables_tests.cpp.o\r\n[ 94%] Building CXX object osquery/CMakeFiles/osquery_tests.dir/core/tests/text_tests.cpp.o\r\n[ 94%] Building CXX object osquery/CMakeFiles/osquery_tests.dir/database/tests/query_tests.cpp.o\r\n[ 95%] Building CXX object osquery/CMakeFiles/osquery_tests.dir/database/tests/results_tests.cpp.o\r\n[ 95%] Building CXX object osquery/CMakeFiles/osquery_tests.dir/database/tests/db_handle_tests.cpp.o\r\n[ 96%] Building CXX object osquery/CMakeFiles/osquery_tests.dir/dispatcher/tests/dispatcher_tests.cpp.o\r\n[ 96%] Building CXX object osquery/CMakeFiles/osquery_tests.dir/events/tests/events_tests.cpp.o\r\n[ 96%] Building CXX object osquery/CMakeFiles/osquery_tests.dir/events/tests/events_database_tests.cpp.o\r\n[ 97%] Building CXX object osquery/CMakeFiles/osquery_tests.dir/extensions/tests/extensions_tests.cpp.o\r\n[ 97%] Building CXX object osquery/CMakeFiles/osquery_tests.dir/filesystem/tests/filesystem_tests.cpp.o\r\n[ 98%] Building CXX object osquery/CMakeFiles/osquery_tests.dir/registry/tests/registry_tests.cpp.o\r\nLinking CXX executable osquery_tests\r\n[ 98%] Built target osquery_tests\r\nScanning dependencies of target run\r\n[ 98%] Building CXX object osquery/CMakeFiles/run.dir/main/run.cpp.o\r\nLinking CXX executable run\r\n[ 98%] Built target run\r\nScanning dependencies of target shell\r\n[100%] Building CXX object osquery/CMakeFiles/shell.dir/devtools/shell.cpp.o\r\n[100%] Building CXX object osquery/CMakeFiles/shell.dir/main/shell.cpp.o\r\nLinking CXX executable osqueryi\r\n[100%] Built target shell\r\n```\r\nI created ```/var/osquery``` and ```/var/log/osquery``` and invoked osqueryd with this config file:\r\n```\r\n{\r\n  \"options\": {\r\n    \"host_identifier\": \"hostname\",\r\n\t\"schedule_splay_percent\": 10\r\n  },\r\n  \"schedule\": {\r\n    \"users\": {\r\n\t  \"query\": \"SELECT username, uid, gid, description, directory, shell FROM users;\",\r\n\t  \"interval\": 180\r\n\t},\r\n\t\"groups\": {\r\n\t  \"query\": \"SELECT groupname, gid FROM groups;\",\r\n\t  \"interval\": 300\r\n\t},\r\n\t\"arp_cache\": {\r\n\t  \"query\": \"SELECT address, mac, interface FROM arp_cache;\",\r\n\t  \"interval\": 300\r\n\t},\r\n\t\"crontab\": {\r\n\t  \"query\": \"SELECT * FROM crontab;\",\r\n\t  \"interval\": 180\r\n\t},\r\n\t\"hosts\": {\r\n\t  \"query\": \"SELECT * FROM etc_hosts;\",\r\n\t  \"interval\": 60\r\n\t},\r\n\t\"services\": {\r\n\t  \"query\": \"SELECT * FROM etc_services;\",\r\n\t  \"interval\": 300\r\n\t},\r\n\t\"if_address\": {\r\n\t  \"query\": \"SELECT interface, address, mask FROM interface_addresses;\",\r\n\t  \"interval\": 600\r\n\t},\r\n\t\"if_details\": {\r\n\t  \"query\": \"SELECT interface, mac, ipackets, opackets, ibytes, obytes, ierrors, oerrors, last_change FROM interface_details;\",\r\n\t  \"interval\": 120\r\n\t},\t\r\n\t\"last\": {\r\n\t  \"query\": \"SELECT * FROM last;\",\r\n\t  \"interval\": 300\r\n\t},\r\n\t\"listening_ports\": {\r\n\t  \"query\": \"SELECT pid, port, protocol, address FROM listening_ports;\",\r\n\t  \"interval\": 60\r\n\t},\r\n\t\"logged_in_users\": {\r\n\t  \"query\": \"SELECT * FROM logged_in_users;\",\r\n\t  \"interval\": 60\r\n\t},\r\n\t\"passwd_changes\": {\r\n\t  \"query\": \"SELECT * FROM passwd_changes;\",\r\n\t  \"interval\": 300\r\n\t},\r\n\t\"processes\": {\r\n\t  \"query\": \"SELECT * FROM processes;\",\r\n\t  \"interval\": 60\r\n\t},\r\n\t\"process_envs\": {\r\n\t  \"query\": \"SELECT * FROM process_envs;\",\r\n\t  \"interval\": 60\r\n\t},\r\n\t\"process_open_files\": {\r\n\t  \"query\": \"SELECT * FROM process_open_files;\",\r\n\t  \"interval\": 60\r\n\t},\r\n\t\"process_open_sockets\": {\r\n\t  \"query\": \"SELECT * FROM process_open_sockets;\",\r\n\t  \"interval\": 60\r\n\t},\r\n\t\"routes\": {\r\n\t  \"query\": \"SELECT destination, netmask, gateway, flags, interface, type FROM routes;\",\r\n\t  \"interval\": 300\r\n\t},\r\n\t\"shell_history\": {\r\n\t  \"query\": \"SELECT * FROM shell_history;\",\r\n\t  \"interval\": 60\r\n\t},\r\n\t\"sysctl\": {\r\n\t  \"query\": \"SELECT * FROM system_controls;\",\r\n\t  \"interval\": 600\r\n\t},\r\n\t\"uptime\": {\r\n\t  \"query\": \"SELECT total_seconds FROM uptime;\",\r\n\t  \"interval\": 60\r\n\t},\r\n\t\"file_events\": {\r\n\t  \"query\": \"SELECT * FROM file_events;\",\r\n\t  \"interval\": 300\r\n\t},\r\n\t\"file_access_events\": {\r\n\t  \"query\": \"SELECT * FROM file_access_events;\",\r\n\t  \"interval\": 300\r\n\t},\r\n\t\"lp_pid\": {\r\n\t  \"query\": \"SELECT process.name, process.pid, listening.port, listening.address FROM processes AS process JOIN listening_ports AS listening ON process.pid = listening.pid;\",\r\n\t  \"interval\": 60\r\n\t},\r\n\t\"uid-gid_to_name\": {\r\n\t  \"query\": \"SELECT ug.uid, users.username, ug.gid, groups.groupname FROM user_groups AS ug JOIN users ON ug.uid = users.uid JOIN groups ON ug.gid = groups.gid;\",\r\n\t  \"interval\": 300\r\n\t},\r\n\t\"iptables\": {\r\n\t  \"query\": \"SELECT * FROM iptables;\",\r\n\t  \"interval\": 120\r\n\t},\r\n\t\"mounts\": {\r\n\t  \"query\": \"SELECT device, device_alias, type, path, flags FROM mounts;\",\r\n\t  \"interval\": 120\r\n\t},\r\n\t\"apt_sources\": {\r\n\t  \"query\": \"SELECT * FROM apt_sources;\",\r\n\t  \"interval\": 300\r\n\t},\r\n\t\"deb_packages\": {\r\n\t  \"query\": \"SELECT * FROM deb_packages;\",\r\n\t  \"interval\": 300\r\n\t}\r\n  }\r\n}\r\n```\r\nThe config is kind of long, but it's for a CTF, and we want to look at a bunch of data points from the boxes.\r\nAfter chowning the osqueryd binary to root:root, invoked osqueryd as follows:\r\n```\r\n$ sudo ./osqueryd --config_path=/etc/osquery/osquery.conf --pidfile=/var/osquery/osqueryd.pidfile --verbose\r\nI1103 00:49:19.584228 26621 init.cpp:280] osquery initialized [version=1.5.3-112-g7b270af]\r\nI1103 00:49:19.594249 26621 system.cpp:174] Found stale process for osqueryd (26541) removing pidfile\r\nI1103 00:49:19.594383 26621 system.cpp:209] Writing osqueryd pid (26621) to /var/osquery/osqueryd.pidfile\r\nI1103 00:49:19.594491 26621 extensions.cpp:171] Could not autoload extensions: Failed reading: /etc/osquery/extensions.load\r\nI1103 00:49:19.595252 26622 watcher.cpp:367] osqueryd watcher (26621) executing worker (26623)\r\nI1103 00:49:19.601683 26623 init.cpp:278] osquery worker initialized [watcher=26621]\r\nI1103 00:49:19.601908 26623 extensions.cpp:178] Could not autoload modules: Failed reading: /etc/osquery/modules.load\r\nI1103 00:49:19.621352 26623 db_handle.cpp:136] Opening RocksDB handle: /var/osquery/osquery.db\r\nI1103 00:49:19.631168 26626 interface.cpp:246] Extension manager service starting: /var/osquery/osquery.em\r\nI1103 00:49:19.636015 26623 events.cpp:563] Event publisher failed setup: kernel: Cannot access /dev/osquery\r\nI1103 00:49:19.636291 26632 events.cpp:506] Starting event publisher run loop: audit\r\nI1103 00:49:19.636353 26623 daemon.cpp:39] Not starting the distributed query service: Distributed query service not enabled.\r\nI1103 00:49:19.636368 26633 events.cpp:506] Starting event publisher run loop: inotify\r\nI1103 00:49:19.636569 26634 events.cpp:506] Starting event publisher run loop: udev\r\nI1103 00:49:25.597563 26622 watcher.cpp:367] osqueryd watcher (26621) executing worker (26637)\r\nI1103 00:49:25.604007 26637 init.cpp:278] osquery worker initialized [watcher=26621]\r\nI1103 00:49:25.604240 26637 extensions.cpp:178] Could not autoload modules: Failed reading: /etc/osquery/modules.load\r\nI1103 00:49:25.604534 26637 db_handle.cpp:146] Opening RocksDB failed: Continuing with read-only support\r\nE1103 00:49:25.604598 26637 init.cpp:421] osqueryd initialize failed: Could not open RocksDB\r\nI1103 00:49:28.604918 26624 watcher.cpp:428] osqueryd worker (26623) detected killed watcher (26621)\r\n```\r\nLooks like for some reason it couldn't open the db.\r\n```\r\n$sudo ls -lR /var/osquery/\r\n/var/osquery/:\r\ntotal 8\r\ndrwx------ 2 root root 4096 Nov  3 00:39 osquery.db\r\n-rw-r--r-- 1 root root    5 Nov  3 00:39 osqueryd.pidfile\r\n\r\n/var/osquery/osquery.db:\r\ntotal 20\r\n-rw-r--r-- 1 root root 2247 Nov  3 00:39 000010.sst\r\n-rw-r--r-- 1 root root 1376 Nov  3 00:39 000014.log\r\n-rw-r--r-- 1 root root   16 Nov  3 00:39 CURRENT\r\n-rw-r--r-- 1 root root   37 Nov  2 05:49 IDENTITY\r\n-rw-r--r-- 1 root root    0 Nov  2 05:49 LOCK\r\n-rw-r--r-- 1 root root    0 Nov  3 00:39 LOG\r\n-rw-r--r-- 1 root root    0 Nov  2 05:49 LOG.old.1446461355655224\r\n-rw-r--r-- 1 root root    0 Nov  2 05:49 LOG.old.1446461361583462\r\n-rw-r--r-- 1 root root    0 Nov  2 05:49 LOG.old.1446529174400201\r\n-rw-r--r-- 1 root root    0 Nov  3 00:39 LOG.old.1446529174427129\r\n-rw-r--r-- 1 root root    0 Nov  3 00:39 LOG.old.1446529180405904\r\n-rw-r--r-- 1 root root  473 Nov  3 00:39 MANIFEST-000013\r\n```\r\nThe filenames, ownership and permissions seem to match up with a known good working instance of osquery running on ubuntu trusty (installed from repo).\r\nI thought maybe there was an issue with the db so I added some simple debug statements to get some more detail...\r\n```\r\n  if (!s.ok()){\r\n    VLOG(1) << \"s.ok() returned False\";\r\n  }\r\n  if (db_ == nullptr) {\r\n    VLOG(1) << \"db_ is null\";\r\n  }\r\n```\r\nThis produces the same output with the addition of:\r\n```\r\nI1103 02:08:30.795699 27370 db_handle.cpp:141] s.ok() returned False\r\nI1103 02:08:30.795754 27370 db_handle.cpp:144] db_ is null\r\n```\r\nI'm not exactly sure why both of these states are occurring. I'm not really sure how to keep debugging this either. Any ideas? Did I perhaps misconfigure something? A quick search of the repo brought up issue #1583, but I'm not sure if that is related. I should point out that I'm seeing this behavior on debian jessie as well."}}