Add missing columns for the kill syscall in the process_events spec
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 23.6k
- Forks
- 2.6k
- Avg merge
- 6d 7h
- Merged PRs (30d)
- 14
Description
The process events table has the ability to show kill events; the PR that added this feature set an additional set of columns specifically for the kill syscall, but they are not actually shown because they are not added to the process_events table spec:
Those columns aren't here https://github.com/osquery/osquery/blob/master/specs/posix/process_events.table.
There is also a question of how to present those additional columns when they are not set.
Currently, the columns that aren't string are set to -1, but is that a possible value that can be returned by the API?
Should we use all empty columns?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Compare the kill-specific columns declared around lines 234-239 of osquery/tables/events/linux/process_events.cpp with the definitions in specs/posix/process_events.table. Determine the expected representation for unset non-string values, then update the table spec so the kill columns and their unset behavior are explicitly covered.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- operating-systems
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100