From 1754f54f9129d8eb6d9a738dba48322345d1de3b Mon Sep 17 00:00:00 2001 From: Aleksandr Maus Date: Wed, 7 Jul 2021 14:27:16 -0700 Subject: [PATCH] Osquerybeat: Change the query timeout from 3 secs to 60 secs (#26775) * The 3 seconds timeout was too low for wifi_survey query for example which was taking more like 5 seconds on the test box. Bumping the value up eliminited timeouts. --- x-pack/osquerybeat/beater/osquerybeat.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/x-pack/osquerybeat/beater/osquerybeat.go b/x-pack/osquerybeat/beater/osquerybeat.go index 24a24623c08..ce185aaf885 100644 --- a/x-pack/osquerybeat/beater/osquerybeat.go +++ b/x-pack/osquerybeat/beater/osquerybeat.go @@ -46,6 +46,8 @@ const ( // The interval in second for configuration refresh; // osqueryd child process requests configuration from the configuration plugin implemented in osquerybeat configurationRefreshIntervalSecs = 60 + + osqueryTimeout = 60 * time.Second ) const ( @@ -176,7 +178,7 @@ func (bt *osquerybeat) Run(b *beat.Beat) error { // Create osqueryd client cli := osqdcli.New(socketPath, osqdcli.WithLogger(bt.log), - osqdcli.WithTimeout(3*time.Second), + osqdcli.WithTimeout(osqueryTimeout), osqdcli.WithCache(cache, adhocOsqueriesTypesCacheSize), ) @@ -201,7 +203,7 @@ func (bt *osquerybeat) Run(b *beat.Beat) error { // Start osquery extensions for logger and configuration g.Go(func() error { - return runExtensionServer(ctx, socketPath, configPlugin, loggerPlugin) + return runExtensionServer(ctx, socketPath, configPlugin, loggerPlugin, osqueryTimeout) }) // Register action handler @@ -246,9 +248,9 @@ func (bt *osquerybeat) Run(b *beat.Beat) error { return g.Wait() } -func runExtensionServer(ctx context.Context, socketPath string, configPlugin *ConfigPlugin, loggerPlugin *LoggerPlugin) (err error) { +func runExtensionServer(ctx context.Context, socketPath string, configPlugin *ConfigPlugin, loggerPlugin *LoggerPlugin, timeout time.Duration) (err error) { // Register config and logger extensions - extserver, err := osquery.NewExtensionManagerServer(extManagerServerName, socketPath) + extserver, err := osquery.NewExtensionManagerServer(extManagerServerName, socketPath, osquery.ServerTimeout(timeout)) if err != nil { return }