Tags: anatol/osquery
Tags
Try to free some disk space on the arm64 runners (osquery#7950)
Improvements to osquery AWS logic (osquery#7714) - Introduce the flag aws_imdsv2_request_attempts to specify how many attempts should be done to retrieve an IMDSv2 token to do a secure request. - Introduce the flag aws_imdsv2_request_interval to specify the base seconds to wait between attempts, which scales quadratically with the number of attempts. - Introduce the flag aws_disable_imdsv1_fallback which disables IMDSv1 as a fallback if the IMDSv2 token fails to be retrieved. - Remove the automatic check to see if osquery is running on an EC2 instance. - Improve the retrieval of instance id and region. If the retrieval keeps failing, don't cache empty values, keep retrying on next requests until it has success, then cache the values. - Improve error message when STS credentials fail to be retrieved. The hardcoded error was hiding the true reason for the failure.
Update `osquery.example.conf` to omit the CLI only flags (osquery#7595)
Fix user_time and system_time unit in processes table on M1 (osquery#… …7473) Use the time base conversion coming from mach_timebase_info also for the cpu time values coming from the libproc API. The user_time and system_time columns values are taken from the proc_pid_rusage API values of ri_user_time and ri_system_time. The unit of those two values was incorrectly considered to always be nanoseconds, but they are mach ticks, much like the start_time that is later calculated via mach_absolute_time. While on x86_64 the time base info used to convert ticks to nanoseconds returns a numerator and denominator that are both 1, on M1 they are not (125 and 3 is one example).
PreviousNext