Jesse Lepich
01/07/2020, 9:14 PMnyanshak
01/07/2020, 9:31 PMWHERE pid=p.parent
(p = current process) but I've found it is not super reliable for a bunch of reasons and pretty inconsistent at bestseph
01/07/2020, 9:38 PMnyanshak
01/07/2020, 9:46 PMSELECT
pe.path,
pe.cmdline,
pe.cwd,
pe.gid,
pe.egid,
pe.uid,
pe.euid,
pe.pid,
pe.parent,
pe.time,
(select coalesce((SELECT cmdline FROM process_events AS parent_cmdline0 WHERE pid=pe.parent), (SELECT cmdline FROM processes AS parent_cmdline1 WHERE pid=pe.parent))) AS parent_cmdline
FROM
process_events AS pe;
seph
01/07/2020, 9:48 PMwith raw as (select
pid,
parent,
path
from processes)
select
p.pid,
p.parent,
p.path as cpath,
pp.path as ppath
from raw as p
left join raw as pp ON p.parent = pp.pid
;
You may not need the temp table there either, but I wasn’t sure if you’d get multiple hits to the process table.