https://github.com/osquery/osquery logo
Title
m

Maksym Varnakov

11/14/2022, 12:10 PM
Hi, I encountered a strange bug - "echo" command is not logged by "process_events" Linux table. Why may it happen?
s

sharvil

11/14/2022, 12:30 PM
echo
is usually a shell built-in command
m

Maksym Varnakov

11/14/2022, 12:31 PM
Thanks for the answer, is there a way to have it logged (maybe using another table or by looking into different processes)?
s

sharvil

11/14/2022, 12:34 PM
for shell builtin commands, there is no separate process, it's the shell that's "executing" it directly, perhaps try searching for your shell in the process_events table?
m

Maksym Varnakov

11/14/2022, 12:45 PM
Thanks for your help! 🙂