@clippy wrt process monitoring - I'd kinda like to talk outside of osquery (ancient curiosity) wrt wtmp/auditd/ttysnoop/history if you have time tomorrow?