Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add list of child processes to running_procs #170

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from

Conversation

mew1033
Copy link
Contributor

@mew1033 mew1033 commented Sep 23, 2019

No description provided.

@mew1033 mew1033 requested a review from fossam September 23, 2019 22:14
Copy link
Contributor

@fossam fossam left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for the PR!

I like the idea as it could be useful - however on my test box with just ~660 processes:

/usr/bin/time /opt/osquery/osqueryi "<sql from the PR>" > /dev/null
52.65user 10.95system 1:07.02elapsed 94%CPU (0avgtext+0avgdata 15036maxresident)k

but same box, same amount of processes:

/usr/bin/time /opt/osquery/osqueryi "<original sql that we'd be replacing>" > /dev/null
0.95user 0.07system 0:01.04elapsed 98%CPU (0avgtext+0avgdata 13004maxresident)k

:(
we need to make it substantially faster. one minute is a bit long just to get child procs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants