wave hey folks I saw this video

Question

wave hey folks I saw this video <https asciinema org a 302647> on `process dns events` table in osquery and I think I remember it being mentioned before in an office hours call is this something that is will be added to osquery

alessandrogario · Answer

Hey Zachary I ended up not implementing it since it requires a uprobe to trace glibc

alessandrogario · Answer

So the major problem there is that if you run a binary that does not use the glibc installed on the system or has a statically linked glibc

alessandrogario · Answer

You won t be able to capture it because it will not trigger the uprobe

alessandrogario · Answer

A dns resolution could also happen with a direct query via socket