Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Osquerybeat: Need to be able to extract osqueryd.exe from osquery MSI package during windows package creation. #29826

Closed
aleksmaus opened this issue Jan 13, 2022 · 1 comment · Fixed by elastic/golang-crossbuild#152 or #30040
Assignees

Comments

@aleksmaus
Copy link
Member

Describe the enhancement:

Need to have msitools installed on the builder docker images for osquerybeat packaging in order to be able to extract osquueryd.exe binary from the official .msi windows distribution package.

Describe a specific use case for the enhancement or feature:

The official signed osquery distro for windows is only available as .MSI package for downloads.
Previously we shipped .MSI inside of osquerybeat bundle for windows and extracted the osqueryd.exe file using msiexec, the very first time osquerybeat was started.
There was a error observed in the logs and reported by one of the customers while running msiexec during osquerybeat installation. We could not reproduce that error and there are multiple potential causes for that specific error message documented by Microsoft.
The solution was to install msitools on the debian docker image during osquerybeat build/packaging for windows and extract the osqueryd.exe binary during osquerybeat build process. Ideally we would like to have these tools baked in into the builder docker image in order to avoid installing them on each build/package request.

Opening this tracker in response to the PR's review comment:
#29801 (comment)

@aleksmaus
Copy link
Member Author

Should not be closed just yet. Need a change in beats as well.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment