chris
12/07/2016, 3:22 PMSELECT * FROM processes where on_disk = 0;
Quickly scan all process's executable paths to check if the binary still exists on disk. If the binary was replaced (with a newer version for example), on_disk will still equal '0'.