
Description: Track the amount of CPU time used by osquery.
SQL:
SELECT ov.version AS os_version, ov.platform AS os_platform,
ov.codename AS os_codename, i.*,
p.resident_size, p.user_time, p.system_time,
time.minutes AS counter, db.db_size_mb AS database_size
FROM osquery_info i, os_version ov, processes p, time,
(SELECT (sum(size) / 1024) / 1024.0 AS db_size_mb FROM
(SELECT value FROM osquery_flags
WHERE name = 'database_path' LIMIT 1) flags, file
WHERE path LIKE flags.value || '%%' AND type = 'regular') db
WHERE p.pid = i.pid;
Operating Systems: Windows, Linux, Apple, FreeBSD
Reference: