I spender a day to find how to select max open files of an user, but can’t find anything? Is the possible to use Osquery to get max open files ?

Hi @Tien Bui I asked my colleague @Vibhor and he says it is possible by joining process_open_files, processes and users table

SELECT f.pid, 
       f.path 
FROM   process_open_files f 
       JOIN processes p 
         ON ( p.pid = f.pid ) 
       JOIN users u 
         ON ( u.UID = p.uid ) 
WHERE  u.username = 'vibhorkumar';