that event will never be picked up

Question

< Prateek Kumar Nischal> that event will never be picked up unless osquery is updated to parse it

alessandrogario · Answer

You can start by updating the following files osquery tables events linux process events cpp osquery events linux process events h osquery events linux auditdnetlink cpp

alessandrogario · Answer

It is mostly adding the ` NR kill` in the std unorderd sets and then enable handling of the event

alessandrogario · Answer

```osquery tables events linux process events cpp Add NR kill to kSyscallNameMap Update the `else` case in `if is exec syscall ` osquery events linux process events h Add kKillProcessEventsSyscalls with NR kill osquery events linux auditdnetlink cpp Inside `if FLAGS audit allow process events ` Add for int syscall kKillProcessEventsSyscalls monitored syscall list insert syscall Additional updates Could be worth adding a `audit allow kill process events` flag There are other kill syscalls that may be interesting to support```

alessandrogario · Answer

Then you may want to test it with ` verbose` and see what happens

Prateek Kumar Nischal · Answer

Awesome thanks for the reply I was guessing there wasn t an implementation for parsing the KILL syscall But I have one question why weren t there any events when there was 3 rules execve execveat and kill From what I am guessing if there aren t processors for kill it should just have ignored those events and the ` audit debug=true` should anyways print those raw audit logs right

Prateek Kumar Nischal · Answer

And I will certainly try to contribute back smile