5 ms·
Could be running something like https://osquery.io/ https://osquery.io/
by theblazehen 5y ago
Could be running something like https://osquery.io/ https://osquery.io/
- philsnow 5y agoIf you can manage to tame it, auditd will give you a much more comprehensive look at what has happened on your machines. osquery is more like polling (on a long interval because it's heavyweight) but auditd is processing events from the kernel.