Reduce log noise for `hash` table by lucasmrod · Pull Request #8626 · osquery/osquery
Fixes fleetdm/fleet#28577.
TL;DR: When hash table is used as scheduled query, the generated WARNING logs fill up the disk space.
Sample:
Without --verbose:
sudo ./osquery/osqueryi
osquery> SELECT * FROM hash WHERE path = '/Users/lucas/Downloads/Win11_24H2_English_Arm64.iso';
+-----------------------------------------------------+------------------------+-----+------+--------+
| path | directory | md5 | sha1 | sha256 |
+-----------------------------------------------------+------------------------+-----+------+--------+
| /Users/lucas/Downloads/Win11_24H2_English_Arm64.iso | /Users/lucas/Downloads | | | |
+-----------------------------------------------------+------------------------+-----+------+--------+
With --verbose:
sudo ./osquery/osqueryi --verbose
osquery> SELECT * FROM hash WHERE path = '/Users/lucas/Downloads/Win11_24H2_English_Arm64.iso';
I0611 10:23:41.937412 -289448192 hashing.cpp:133] Failed to hash /Users/lucas/Downloads/Win11_24H2_English_Arm64.iso: Cannot read /Users/lucas/Downloads/Win11_24H2_English_Arm64.iso size exceeds limit: 5460387840 > 52428800
+-----------------------------------------------------+------------------------+-----+------+--------+
| path | directory | md5 | sha1 | sha256 |
+-----------------------------------------------------+------------------------+-----+------+--------+
| /Users/lucas/Downloads/Win11_24H2_English_Arm64.iso | /Users/lucas/Downloads | | | |
+-----------------------------------------------------+------------------------+-----+------+--------+