socket_events can't get data when it left join process_events I encountered strange things.I record my computer's some info with socket_events and process_events.here is my sql.

sql
select * from process_events
select socket_events.*,process_events.cmdline,process_events.cwd,process_events.pid as pepid from socket_events left join process_events  on socket_events.pid=process_events.pid;

but I found that the

cmdline

,

cwd

,

pepid

are all empty in

socket_events

.for eaxmple

cmd:  curl <https://osquery.io>

name": "process_events",
    "@version": "1",
    "columns": {
      "parent": "21451",
      "cwd": "\"/root\"",
      "btime": "0",
      "auid": "1001",
      "egid": "0",
      "atime": "1448209686",
      "owner_gid": "0",
      "owner_uid": "0",
      "path": "/usr/bin/curl",
      "cmdline": "curl <https://osquery.io>",
      "gid": "0",
      "pid": "21923",
      "ctime": "1461222192",
      "time": "1543840554",
      "uptime": "28088276",
      "mode": "0100755",
      "mtime": "1448209686",
      "uid": "0",
      "euid": "0"
    },


"name": "socket_events",
"@version": "1",
"columns": {
    "pepid": "",
    "local_port": "0",
    "cwd": "",
    "status": "unknown",
    "auid": "1001",
    "path": "/usr/bin/curl",
    "action": "connect",
    "cmdline": "",
    "family": "2",
    "fd": "3",
    "pid": "21923",
    "local_address": "",
    "remote_port": "443",
    "time": "1543840554",
    "uptime": "28088276",
    "remote_address": "54.193.126.242"
},

as you can see,the

socket_events

row has the same pid with the

process_events

row,but the

cwd

,

cmdline

,

pepid

are all empty in

socket_events

table. it it very strange. this Scenario has happened in all my 10 host.

Sorry, I have not come across this. It's not a query we use. From your description, it looks like a bug in osquery.

OK,It seems that I must wait.Do you have an clue what is the root cause?I think maybe the problem is the sqlite parser,but I can't find the sqlite parse code in osquery.

I haven't had time to look. If you haven't filed an issue for this on github, I recommend you do so.

events_optimize=false

is useless

Hey @钢铁侠 for your security related activities, are you able to parse the windows events source or just with the windows event ids is enough to address your needs

we just osquery to record the linux infos.but if we can join socket_events and process_events with pid,we can have the full info about one process.so we nedd left join.