Query to find the Process Tree

Query to find the Process Tree


Query
WITH pstree

AS (SELECT 0 AS LEVEL,

pid,

name,

parent,

Cast(pid AS TEXT) AS ppid,

name AS pparent

FROM processes

WHERE parent = 0

UNION ALL

SELECT LEVEL + 1,

t.pid,

t.name,

t.parent,

pstree.ppid

|| ', '

|| Cast(t.pid AS TEXT),

pstree.pparent

|| ', '

|| t.name

FROM processes t

inner join pstree

ON t.parent = pstree.pid)

SELECT *

FROM pstree;





    • Related Articles

    • Query to find Inbound / Outbound connections on Mac

      Query WITH mac_assets AS (SELECT t.upt_asset_id FROM upt_asset_tags t WHERE t.key = 'upt-mac-edr') SELECT DISTINCT pos.upt_asset_id, ps.name, pos.pid, pos.local_address, pos.remote_address, pos.local_port, pos.remote_port, CASE WHEN pos.pid = lp.pid ...
    • Query to find Processes Running

      Processes running between certain times Query SELECT * FROM windowed_processes p WHERE p.upt_add_time >= <TIMESTAMP> AND p.upt_add_time <= <TIMESTAMP>; Example All processes running between 2018-07-18 2:00 to 2018-08-18 3:00 SELECT * FROM ...
    • Find Realtime queries executed in the last 24 hours

      This article includes the query to find all the real time queries that were executed in the last 24 hours Query WITH queries      AS (SELECT Json_extract_scalar(logs.api_body, '$.query')   AS query, ...
    • Query to find Processes delta between last 2 weeks

      Query WITH last_week_processes_cmds AS ( SELECT DISTINCT upt_asset_id, name, cmdline, path FROM processes WHERE upt_day >= Cast(Date_format(current_date - interval '14' day, '%Y%m%d') AS INTEGER) AND upt_day < Cast(Date_format(current_date - interval ...
    • Process_Open_Sockets v/s Socket_Events

      This article explains the difference between socket information captured by Process_open_sockets and socket_events. The article is also applicable in case of processes i.e process information captured by table 'Processes' and table 'Process_events' ...