valitydev/osquery-1
14
0
Fork 0
mirror of https://github.com/valitydev/osquery-1.git synced 2024-11-07 18:08:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

A fix for Mac OSX process start_time (#3534)

Browse Source
This commit is contained in:
Hugh Neale 2017-08-08 01:49:12 +01:00 committed by Teddy Reed
parent 8a963e8d40
commit 2b48fbc557
1 changed files with 16 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
osquery/tables/system/darwin/processes.cpp
View File

@ -31,6 +31,8 @@ namespace fs = boost::filesystem;
namespace osquery {
namespace tables {
extern long getUptime();
// The maximum number of expected memory regions per process.
#define MAX_MEMORY_MAPS 512
@ -310,9 +312,20 @@ QueryData genProcesses(QueryContext& context) {
r["system_time"] = TEXT(rusage_info_data.ri_system_time / CPU_TIME_RATIO);
// Convert the time in CPU ticks since boot to seconds.
// This is relative to time not-sleeping since boot.
r["start_time"] =
TEXT((rusage_info_data.ri_proc_start_abstime / START_TIME_RATIO) *
time_base.numer / time_base.denom);
auto uptime = tables::getUptime();
uint64_t absoluteTime = mach_absolute_time();
auto multiply = static_cast<double>(time_base.numer) /
static_cast<double>(time_base.denom);
auto diff = static_cast<long>(
(rusage_info_data.ri_proc_start_abstime - absoluteTime));
// This is a negative value
auto seconds_since_launch =
static_cast<long>((diff * multiply) / START_TIME_RATIO);
// Get the start_time since the computer started
r["start_time"] = TEXT(uptime + seconds_since_launch);
} else {
r["wired_size"] = "-1";
r["resident_size"] = "-1";