Title
#general
t

Tien Bui

09/21/2018, 2:09 AM
I spender a day to find how to select max open files of an user, but can’t find anything? Is the possible to use Osquery to get max open files ?
AmberP

AmberP

09/26/2018, 3:17 PM
Hi @Tien Bui I asked my colleague @Vibhor and he says it is possible by joining process_open_files, processes and users table
SELECT f.pid, 
       f.path 
FROM   process_open_files f 
       JOIN processes p 
         ON ( p.pid = f.pid ) 
       JOIN users u 
         ON ( u.UID = p.uid ) 
WHERE  u.username = 'vibhorkumar';