mirror of
https://github.com/valitydev/osquery-1.git
synced 2024-11-07 09:58:54 +00:00
b81b6de6ae
The refactor of config/packs was initiated because event subscribers needed a method for toggling `::init` based on some configurable option. In the case of auditd, turning on the support with `--disable_audit=false` used to start auditing the EXECVE syscall. It was understandable that this would cause latency based on the number of processes executing per measure of time. A new `socket_events` table will do the same but for `bind` and `connect`. These are less-obvious and for now, require a scan of /proc for socket tuples. In the future this file descriptor to socket tuple will be faster.
19 lines
879 B
Plaintext
19 lines
879 B
Plaintext
table_name("process_open_sockets")
|
|
description("Processes which have open network sockets on the system.")
|
|
schema([
|
|
Column("pid", INTEGER, "Process (or thread) ID", index=True),
|
|
Column("fd", BIGINT, "Socket file descriptor number"),
|
|
Column("socket", BIGINT, "Socket handle or inode number"),
|
|
Column("family", INTEGER, "Network protocol (IPv4, IPv6)"),
|
|
Column("protocol", INTEGER, "Transport protocol (TCP/UDP)"),
|
|
Column("local_address", TEXT, "Socket local address"),
|
|
Column("remote_address", TEXT, "Socket remote address"),
|
|
Column("local_port", INTEGER, "Socket local port"),
|
|
Column("remote_port", INTEGER, "Socket remote port"),
|
|
Column("path", TEXT, "For UNIX sockets (family=AF_UNIX), the domain path"),
|
|
])
|
|
implementation("system/process_open_sockets@genOpenSockets")
|
|
examples([
|
|
"select * from process_open_sockets where pid = 1",
|
|
])
|