When trying to run a scheduled query in Panther, the following error occurs:
FailedQuery('status: error: error:could not query sqlite file for column info for ...: database is locked')
Is there anything I need to do to resolve this or ensure that this doesn't happen again?
If you encounter the
database is locked error for a scheduled query, you should re-run it, as the associated rules/detections were not run on the results.
While this is a transient issue, the system should normally retry running the scheduled query. However, a current bug is preventing this from happening, requiring you to manual re-run it. Our engineering team is investigating and working on a solution.