<@U09M563C7> that works a treat
```
osquery> s...
# generali
infomaniac
02/02/2017, 7:23 PM@theopolis that works a treat
Copy code
osquery> select * FROM process_open_files where pid = 6245;
pid = 6245
fd = 0
path = /dev/pts/11
pid = 6245
fd = 1
path = /dev/pts/11
pid = 6245
fd = 10
path = /tmp/x (deleted)
pid = 6245
fd = 2
path = /dev/pts/11