Skip to content

BrokenPipeError when running deb_packages query #86

Description

@SarthakAdhikari

Bug report

What operating system and version are you using?

Description: Ubuntu 20.04.3 LTS
Release: 20.04
Codename: focal

What version of osquery are you using?

5.2.3

What steps did you take to reproduce the issue?

  1. Open a brand new EC2 Ubuntu instance

  2. Install osquery by performing the following

 sudo apt-get install -y gnupg software-properties-common python3-pip
export debian_frontend=noninteractive
export osquery_key=1484120ac4e9f8a1a577aeee97a80c63c9d8b80b
sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys $osquery_key
sudo add-apt-repository 'deb [arch=amd64] https://pkg.osquery.io/deb deb main'
sudo apt-get -y update
sudo apt-get -y install osquery
pip3 install osquery==3.0.7
  1. Run this small reproducible example:
 import osquery
import time
instance = osquery.SpawnInstance()
instance.open()
for i in range(5):
# throws error in third iteration of `i`
query = instance.client.query("select * from deb_packages")
print(query.response)
time.sleep(2)
  1. The following error during the third iteration of the loop:
 Traceback (most recent call last):
File "/home/ubuntu/.local/lib/python3.10/site-packages/thrift/transport/TSocket.py", line 178, in write
plus = self.handle.send(buff)
BrokenPipeError: [Errno 32] Broken pipe
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/home/ubuntu/osquery_demo.py", line 9, in <module>
query = instance.client.query("select * from deb_packages")
File "/home/ubuntu/.local/lib/python3.10/site-packages/osquery/extensions/ExtensionManager.py", line 181, in query
self.send_query(sql)
File "/home/ubuntu/.local/lib/python3.10/site-packages/osquery/extensions/ExtensionManager.py", line 190, in send_query
self._oprot.trans.flush()
File "/home/ubuntu/.local/lib/python3.10/site-packages/thrift/transport/TTransport.py", line 179, in flush
self.__trans.write(out)
File "/home/ubuntu/.local/lib/python3.10/site-packages/thrift/transport/TSocket.py", line 185, in write
raise TTransportException(message="unexpected exception", inner=e)
thrift.transport.TTransport.TTransportException: unexpected exception

What did you expect to see?

I expected osquery to return the query result for deb_packages 5 times(in the above demo example).

What did you see instead?

osquery successfully returned deb_packages two times in the loop but raised a BrokenPipeError exception on the third iteration of the loop.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions