Proposal which I can raise on GitHub as a blueprint but want

Question

Proposal which I can raise on GitHub as a blueprint but wanted to post here for quick discussion first since we ll have `bpf process events` and `es process events` should we rename the original to `audit process events` The code should facilitate this aliasing without breaking people s existing queries Essentially `process events` will become a clone of `audit process events` and will not show up in documentation schema listing but the virtual table will exist

sundsta · Answer

Makes sense to me

Mike Myers · Answer

<https github com osquery osquery pull 6571 issuecomment 665922702> Alessandro told me this last time but maybe you re asking a slightly different question

Mike Myers · Answer

Like I guess they collect slightly different event fields and therefore he thought they are not interchangeable

alessandrogario · Answer

Maybe we could come up with a small subset of columns that should be always present and use those in the alias as some sort of interface

alessandrogario · Answer

Mike is right the bpf process events table already has some things that process events can t easily have duration how much time it took to service the system call ntime nsecs timestamp of the syscall relative to the boot time as provided by BPF cid cgroup id

theopolis · Answer

For most things we try to abstract the concept across operating systems But there is too much nuance configuration and expectation setting with process eventing so it makes sense to have them technology specific We can iterate though