From e33391e8d3e5b2149174b6b84d869110f094f217 Mon Sep 17 00:00:00 2001 From: Zach Wasserman Date: Mon, 24 May 2021 20:36:40 -0700 Subject: [PATCH] Cleanup live query store for orphaned query (#847) Cleans up a case in which a query could continue to be returned even after it had been detected orphaned. --- server/service/service_osquery.go | 3 +++ server/service/service_osquery_test.go | 2 ++ 2 files changed, 5 insertions(+) diff --git a/server/service/service_osquery.go b/server/service/service_osquery.go index 2a677a3d37..ae71ba86c0 100644 --- a/server/service/service_osquery.go +++ b/server/service/service_osquery.go @@ -1010,6 +1010,9 @@ func (svc service) ingestDistributedQuery(host kolide.Host, name string, rows [] // execute that query when we can't write to any subscriber campaign, err := svc.ds.DistributedQueryCampaign(uint(campaignID)) if err != nil { + if err := svc.liveQueryStore.StopQuery(strconv.Itoa(int(campaignID))); err != nil { + return osqueryError{message: "stop orphaned campaign after load failure: " + err.Error()} + } return osqueryError{message: "loading orphaned campaign: " + err.Error()} } diff --git a/server/service/service_osquery_test.go b/server/service/service_osquery_test.go index 0b5fac6ecc..aa4eaac57b 100644 --- a/server/service/service_osquery_test.go +++ b/server/service/service_osquery_test.go @@ -1321,6 +1321,8 @@ func TestIngestDistributedQueryOrphanedCampaignLoadError(t *testing.T) { return nil, fmt.Errorf("missing campaign") } + lq.On("StopQuery", "42").Return(nil) + host := kolide.Host{ID: 1} err := svc.ingestDistributedQuery(host, "fleet_distributed_query_42", []map[string]string{}, false, "")