inotify generating errors for failures on files that are treated as directories.
Opened this issue · 1 comments
kswagler-rh commented
Bug report
When running osquery with file events enabled on Linux systems an error is generated when a file is attempted to be added as a directory. Eg.
osqueryd[29801]: W1121 14:47:32.353986 29801 inotify.cpp:371] Could not add inotify watch on: /usr/bin/rpm/
$ ls -l /usr/bin/rpm
-rwxr-xr-x. 1 root root 20520 Nov 13 01:00 /usr/bin/rpm
What operating system and version are you using?
Fedora 39
What version of osquery are you using?
5.10.2
What steps did you take to reproduce the issue?
Add a directory with files such as /usr/bin to FIM events
Run osquery in verbose mode
What did you expect to see?
No warnings on adding a file listener to a file
What did you see instead?
Warnings that a file could not have an inotify watch because it is not a directory.
m8ram commented
The warning comes from
osquery/osquery/events/linux/inotify.cpp
Lines 370 to 371 in df26c47