```
osquery> SELECT pid, cmdline, on_disk FROM ...
# generala
andrew-d
12/07/2016, 6:42 AM Copy code
osquery> SELECT pid, cmdline, on_disk FROM processes WHERE on_disk <> 1;
+------+----------------+---------+
| pid | cmdline | on_disk |
+------+----------------+---------+
| 9353 | ./removes_self | -1 |
+------+----------------+---------+