Skip to content

Conversation

@mew1033
Copy link
Contributor

@mew1033 mew1033 commented Sep 23, 2019

No description provided.

@mew1033 mew1033 requested a review from fossam September 23, 2019 22:14
Copy link
Contributor

@fossam fossam left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for the PR!

I like the idea as it could be useful - however on my test box with just ~660 processes:

/usr/bin/time /opt/osquery/osqueryi "<sql from the PR>" > /dev/null
52.65user 10.95system 1:07.02elapsed 94%CPU (0avgtext+0avgdata 15036maxresident)k

but same box, same amount of processes:

/usr/bin/time /opt/osquery/osqueryi "<original sql that we'd be replacing>" > /dev/null
0.95user 0.07system 0:01.04elapsed 98%CPU (0avgtext+0avgdata 13004maxresident)k

:(
we need to make it substantially faster. one minute is a bit long just to get child procs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants