but osquery is useful for the process info