Jesse Lepich01/07/2020, 9:14 PM
nyanshak01/07/2020, 9:31 PM
(p = current process) but I've found it is not super reliable for a bunch of reasons and pretty inconsistent at best
nyanshak01/07/2020, 9:46 PM
SELECT pe.path, pe.cmdline, pe.cwd, pe.gid, pe.egid, pe.uid, pe.euid, pe.pid, pe.parent, pe.time, (select coalesce((SELECT cmdline FROM process_events AS parent_cmdline0 WHERE pid=pe.parent), (SELECT cmdline FROM processes AS parent_cmdline1 WHERE pid=pe.parent))) AS parent_cmdline FROM process_events AS pe;
You may not need the temp table there either, but I wasn’t sure if you’d get multiple hits to the process table.
with raw as (select pid, parent, path from processes) select p.pid, p.parent, p.path as cpath, pp.path as ppath from raw as p left join raw as pp ON p.parent = pp.pid ;