chris
07/06/2018, 7:18 PM"packs": {
"test": "/usr/share/osquery/packs/test.conf"
}
and then `/usr/share/osquery/packs/test.conf`:
{
"queries": {
"osquery_info": {
"query": "select i.*, p.resident_size, p.user_time, p.system_time, time.minutes as counter from osquery_info i, processes p, time where p.pid = i.pid;",
"interval": 600,
"removed": false,
"blacklist": false,
"version": "1.2.2",
"description": "A heartbeat counter that reports general performance (CPU, memory) and version."
}
}
}