{"push_id":843075582,"size":2,"distinct_size":2,"ref":"refs/heads/master","head":"811d5787398a41b49d0625325f951d372c4609c5","before":"34f5f2cec1797285bf4dd67221099be92b7d8e80","commits":[{"sha":"b81b6de6ae3f957bfbeca68be72ed0a295a1ba34","author":{"email":"8e253411902717ec585a7911662d2d8f285d52d0@prosauce.org","name":"Teddy Reed"},"message":"This refactors a bit of config/packs and adds a socket_events table to Linux.\n\nThe refactor of config/packs was initiated because event subscribers needed\na method for toggling `::init` based on some configurable option. In the case\nof auditd, turning on the support with `--disable_audit=false` used to start\nauditing the EXECVE syscall. It was understandable that this would cause\nlatency based on the number of processes executing per measure of time.\n\nA new `socket_events` table will do the same but for `bind` and `connect`. These\nare less-obvious and for now, require a scan of /proc for socket tuples. In the\nfuture this file descriptor to socket tuple will be faster.","distinct":true,"url":"https://api.github.com/repos/facebook/osquery/commits/b81b6de6ae3f957bfbeca68be72ed0a295a1ba34"},{"sha":"811d5787398a41b49d0625325f951d372c4609c5","author":{"email":"8e253411902717ec585a7911662d2d8f285d52d0@prosauce.org","name":"Teddy Reed"},"message":"Merge pull request #1599 from theopolis/socket_events\n\nRefactor a bit of config and add socket_events table to Linux","distinct":true,"url":"https://api.github.com/repos/facebook/osquery/commits/811d5787398a41b49d0625325f951d372c4609c5"}]}