https://github.com/osquery/osquery logo
Title
t

theopolis

08/26/2020, 3:10 PM
I don’t have the code in front of me right now but it sounds like osquery’s information is incomplete, meaning it does not expose all of /proc/meminfo. You might need to change the information provided in the memory_info table.
m

MoodyMudit

08/27/2020, 6:26 AM
Is there some documentation using which I can easily modify existing osquery tables?