Bug report

Two of the machines I was trying to use the windows_eventlog table on crashed on queries to it (but others were fine!). This was happening even with a very basic query like 'select data FROM windows_eventlog WHERE channel="Security";' This appears to be related to some data in that particular log, as clearing the log allows the query to run. This is consistent with only seeing it on some systems and not others. It's happened on at least two machines, though I only have access to one right now, but it's a mostly fresh VM deploy. I can upload the crash dump (it's a buffer overflow) and the exported event log shortly.

What operating system and version are you using?

The one I have access to at the moment is Windows 10 1803 (17134); another one reported to me was Windows 10 21H2 (19044).

What version of osquery are you using?

I tried this with both 4.8.0 and 5.0.1 and got the same crash.

What steps did you take to reproduce the issue?

Ran a variety of queries with the windows_eventlog table and found that the crash happened with any of them that specifically queried the "Security" log on this machine. The other machine that I was told this happened on was querying Application, which still fits with the idea that it's just some data in a log that's causing this rather than anything specific to any specific log. And to reiterate, clearing the log on the affected system allowed the queries to run as expected.

What did you expect to see?

A successful query returning data

What did you see instead?

An osqueryi crash