osquery-1/osquery/tables/specs/x/processes.table
Alexander Polyakov c0d827f534 Add euid / egid to process table
(not tested on darwin)
2014-11-06 01:35:52 +03:00

21 lines
844 B
Plaintext

table_name("processes")
schema([
Column(name="name", type="std::string"),
Column(name="path", type="std::string"),
Column(name="cmdline", type="std::string"),
Column(name="pid", type="int"),
Column(name="uid", type="long long int"),
Column(name="gid", type="long long int"),
Column(name="euid", type="long long int"),
Column(name="egid", type="long long int"),
Column(name="on_disk", type="std::string"),
Column(name="wired_size", type="std::string"),
Column(name="resident_size", type="std::string"),
Column(name="phys_footprint", type="std::string"),
Column(name="user_time", type="std::string"),
Column(name="system_time", type="std::string"),
Column(name="start_time", type="std::string"),
Column(name="parent", type="int"),
])
implementation("system/processes@genProcesses")