togal
03/30/2021, 7:14 AMblaedj
03/30/2021, 12:57 PMtheopolis
03/30/2021, 1:52 PMsoft_limit
and hard_limit
are most likely different because of how osquery is being run. When you run a process in a shell it inherits the limits from that shell, however if it is run with root (or similar) privileges then that process may change its limits. When a process is run from systemd or similar then it will inherit different limits, most likely more conservative values. I think this is expected, as these limits are applied per-process. https://ss64.com/bash/ulimit.html
What are you trying to achieve with that query?blaedj
03/30/2021, 1:58 PM