osquery-python icon indicating copy to clipboard operation
osquery-python copied to clipboard

thrift.transport.TTransport.TTransportException: Called read on non-open pipe

Open newdjangodev opened this issue 5 years ago • 1 comments

I have a connection error. Any suggestions? Thank you

PS C:\WINDOWS\system32> python 'C:\Users\sampng\Desktop\python_script\superset.py'                                      Traceback (most recent call last):
  File "C:\Users\sampng\Desktop\python_script\superset.py", line 10, in <module>
    result=instance.client.query("select * from time")
  File "C:\Users\sampng\AppData\Local\Programs\Python\Python36\lib\site-packages\osquery\extensions\ExtensionManager.py", line 181, in query
    self.send_query(sql)
  File "C:\Users\sampng\AppData\Local\Programs\Python\Python36\lib\site-packages\osquery\extensions\ExtensionManager.py", line 190, in send_query
    self._oprot.trans.flush()
  File "C:\Users\sampng\AppData\Local\Programs\Python\Python36\lib\site-packages\thrift\transport\TTransport.py", line 179, in flush
    self.__trans.write(out)
  File "C:\Users\sampng\AppData\Local\Programs\Python\Python36\lib\site-packages\osquery\TPipe.py", line 128, in write
    message='Called read on non-open pipe')
thrift.transport.TTransport.TTransportException: Called read on non-open pipe

My Python script:

import os
import osquery

if __name__ == "__main__":
    # Spawn an osquery process using an ephemeral extension socket.
    instance = osquery.SpawnInstance(r"C:\Program Files\osquery\osqueryi.exe")
    instance.open()  # This may raise an exception

    # Issues queries and call osquery Thrift APIs.
    result=instance.client.query("select * from time")
    print (result)

newdjangodev avatar Aug 07 '20 08:08 newdjangodev

I believe you should spawn osqueryd process instead of osqueryi. Try this: instance = osquery.SpawnInstance(r"C:\Program Files\osquery\osqueryd\osqueryd.exe")

prasanthbazz avatar Jul 28 '21 12:07 prasanthbazz