{"action":"created","issue":{"url":"https://api.github.com/repos/facebook/osquery/issues/2405","repository_url":"https://api.github.com/repos/facebook/osquery","labels_url":"https://api.github.com/repos/facebook/osquery/issues/2405/labels{/name}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/2405/comments","events_url":"https://api.github.com/repos/facebook/osquery/issues/2405/events","html_url":"https://github.com/facebook/osquery/issues/2405","id":172718689,"number":2405,"title":"OSquery defunct process","user":{"login":"msims-okta","id":2512270,"avatar_url":"https://avatars.githubusercontent.com/u/2512270?v=3","gravatar_id":"","url":"https://api.github.com/users/msims-okta","html_url":"https://github.com/msims-okta","followers_url":"https://api.github.com/users/msims-okta/followers","following_url":"https://api.github.com/users/msims-okta/following{/other_user}","gists_url":"https://api.github.com/users/msims-okta/gists{/gist_id}","starred_url":"https://api.github.com/users/msims-okta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/msims-okta/subscriptions","organizations_url":"https://api.github.com/users/msims-okta/orgs","repos_url":"https://api.github.com/users/msims-okta/repos","events_url":"https://api.github.com/users/msims-okta/events{/privacy}","received_events_url":"https://api.github.com/users/msims-okta/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/facebook/osquery/labels/events","name":"events","color":"207de5"},{"url":"https://api.github.com/repos/facebook/osquery/labels/Linux","name":"Linux","color":"d4c5f9"},{"url":"https://api.github.com/repos/facebook/osquery/labels/triage","name":"triage","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2016-08-23T14:44:52Z","updated_at":"2016-09-02T15:06:21Z","closed_at":null,"body":"osquery-1.8.1-1.el6.x86_64 installed\r\nUsing AWS Linux.\r\n\r\nEvery few minutes the osquery process becomes defunct. A new one does start up but we're left with this:\r\n\r\n> root     12730 28.2  0.0      0     0 ?        ZN   15:53   0:52 [osqueryd] \\<defunct\\>\r\n> root     16092 11.0  0.2 967984 19792 ?        SNl  15:56   0:00 osqueryd                                                                                         \r\n> root     30296  0.0  0.0 285932  7248 ?        SNsl 15:40   0:00 osqueryd --config_path=/etc/osquery/osquery.conf --pidfile=/var/run/osqueryd.pid --daemonize=true\r\n> \r\n\r\nThese are the last lines in WARNING before the process dies.\r\n\r\n> W0823 14:40:07.895736 20294 events.cpp:304] Expiring events for subscriber: file_events limit (1000) exceeded: 1248\r\n> W0823 14:40:10.598011 20293 events.cpp:304] Expiring events for subscriber: process_events limit (1000) exceeded: 1255\r\n> W0823 14:40:11.580380 20294 events.cpp:304] Expiring events for subscriber: file_events limit (1000) exceeded: 1196\r\n> W0823 14:40:15.710403 20294 events.cpp:304] Expiring events for subscriber: file_events limit (1000) exceeded: 1246\r\n> W0823 14:40:20.127872 20294 events.cpp:304] Expiring events for subscriber: file_events limit (1000) exceeded: 1163"},"comment":{"url":"https://api.github.com/repos/facebook/osquery/issues/comments/244401375","html_url":"https://github.com/facebook/osquery/issues/2405#issuecomment-244401375","issue_url":"https://api.github.com/repos/facebook/osquery/issues/2405","id":244401375,"user":{"login":"msims-okta","id":2512270,"avatar_url":"https://avatars.githubusercontent.com/u/2512270?v=3","gravatar_id":"","url":"https://api.github.com/users/msims-okta","html_url":"https://github.com/msims-okta","followers_url":"https://api.github.com/users/msims-okta/followers","following_url":"https://api.github.com/users/msims-okta/following{/other_user}","gists_url":"https://api.github.com/users/msims-okta/gists{/gist_id}","starred_url":"https://api.github.com/users/msims-okta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/msims-okta/subscriptions","organizations_url":"https://api.github.com/users/msims-okta/orgs","repos_url":"https://api.github.com/users/msims-okta/repos","events_url":"https://api.github.com/users/msims-okta/events{/privacy}","received_events_url":"https://api.github.com/users/msims-okta/received_events","type":"User","site_admin":false},"created_at":"2016-09-02T15:06:21Z","updated_at":"2016-09-02T15:06:21Z","body":"Thanks all for your assistance. We pointed file_access to a quiet directory only (/root) and all the warnings stopped. So we'll figure out how to proceed with this."}}
{"actor":{"display_login":"msims-okta"}}