# bro-osquery - socket\_events **URL:** \ **Category:** Zeek\ **Created:** [September 10, 2018, 3:25pm UTC](https://community.zeek.org/t/bro-osquery-socket-events/5448 "2018-09-10T15:25:22Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Neslog](https://avatars.discourse-cdn.com/v4/letter/n/7cd45c/32.png) [@Neslog](https://community.zeek.org/u/Neslog)\ **Post date:** [September 10, 2018, 3:25pm UTC](https://community.zeek.org/t/bro-osquery-socket-events/5448/1 "2018-09-10T15:25:22Z")
Hello all - I’m looking at gathering host processes that make connections to the network/internet. When trying out bro-osquery I’m getting the following error. 1536590781.935421 error: Bad IP address: fe80::b22f:47fa:b41f:7ce8%em1 1536590781.935421 error: Bad IP address: fe80::b22f:47fa:b41f:7ce8%em1 Here is my scirpt: event host\_socket\_event(resultInfo: osquery::ResultInfo, action: string, pid: int, path: string, family: int, protocol: int, local\_address: string, remote\_address: string, local\_port: int, remote\_port: int, start\_time: int, success: int) { print “host\_socket\_event”; } When looking at socket\_events table I’m not seeing any data. I am receiving the following error from auditd. I0910 10:57:12.063364 1615 auditdnetlink.cpp:613] Failed to set the netlink owner I0910 10:57:17.063714 1615 auditdnetlink.cpp:613] Failed to set the netlink owner That is what I’m seeing while trying to run osqueryi. Has anyone run into this before? Looks like there’s an open ticket from the iBigQ guys stating that they cannot upgrade their version of OSQuery yet. [https://github.com/facebook/osquery/issues/4145](https://github.com/facebook/osquery/issues/4145) N ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/bro-osquery-socket-events/5448/2 "2022-05-06T15:46:02Z")
Closed on May 6, 2022, 3:46pm UTC