good afternoon guys! qq: what was the flag I need to give to have content in table
process_events
? I thought there was a flag....Thanks a bunch ๐
t
thor
10/11/2018, 8:11 PM
Does - - disable_events=false work for you?
On mobile so canโt do my fancy formatting :)
j
jackjack
10/12/2018, 8:48 PM
unfortunately it didn't ๐
@thor can you educate me a little on what exactly is this table for? Can't seem to find that in the docs ๐ Thank you sir!
t
thor
10/13/2018, 3:26 AM
Hey @jackjack, have you checked out this part of the readthedocs on our eventing framework? https://osquery.readthedocs.io/en/stable/development/pubsub-framework/ That might give some more overview as to how it works, but in essence that table is for "flight recording" process executions, so enabling the events should have osquery start monitoring process starts