mirror of
https://github.com/valitydev/osquery-1.git
synced 2024-11-07 09:58:54 +00:00
32 lines
1.5 KiB
Plaintext
32 lines
1.5 KiB
Plaintext
table_name("processes")
|
|
description("All running processes on the host system.")
|
|
schema([
|
|
Column("pid", BIGINT, "Process (or thread) ID", index=True),
|
|
Column("name", TEXT, "The process path or shorthand argv[0]"),
|
|
Column("path", TEXT, "Path to executed binary"),
|
|
Column("cmdline", TEXT, "Complete argv"),
|
|
Column("state", TEXT, "Process state"),
|
|
Column("cwd", TEXT, "Process current working directory"),
|
|
Column("root", TEXT, "Process virtual root directory"),
|
|
Column("uid", BIGINT, "Unsigned user ID"),
|
|
Column("gid", BIGINT, "Unsigned group ID"),
|
|
Column("euid", BIGINT, "Unsigned effective user ID"),
|
|
Column("egid", BIGINT, "Unsigned effective group ID"),
|
|
Column("on_disk", INTEGER,
|
|
"The process path exists yes=1, no=0, unknown=-1"),
|
|
Column("wired_size", BIGINT, "Bytes of unpagable memory used by process"),
|
|
Column("resident_size", BIGINT, "Bytes of private memory used by process"),
|
|
Column("phys_footprint", BIGINT, "Bytes of total physical memory used"),
|
|
Column("user_time", BIGINT, "CPU time spent in user space"),
|
|
Column("system_time", BIGINT, "CPU time spent in kernel space"),
|
|
Column("start_time", BIGINT,
|
|
"Process start in seconds since boot (non-sleeping)"),
|
|
Column("parent", BIGINT, "Process parent's PID"),
|
|
Column("group", BIGINT, "Process group"),
|
|
Column("nice", INTEGER, "Process nice level (-20 to 20, default 0)"),
|
|
])
|
|
implementation("system/processes@genProcesses")
|
|
examples([
|
|
"select * from processes where pid = 1",
|
|
])
|