[osquery] Simple LRU cache implementation #5521
Closed
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Stack:
:white_circle: #5527 [osquery] Rename system:cpu target to system:cpu_topology 💛
:white_circle: #5519 [osquery] Implement even producer to trace syscalls {kill, setuid} and dump them to experimental events streaming registry 💚
:white_circle: #5520 [osquery] Helper function to read process cmdline from
/proc/<pid>/cmdline
on linux by PID 💚:black_circle: #5521 [osquery] Simple LRU cache implementation 💚
Implementation based on
std::unordered_map
andstd::list
, without anyage-bits or any sort of optimisations. If later we realize we need something
more powerfull we will use some fancy OSS lib for it.
I need it as a cache of "hot" processes in syscall traicing. To read cmdline
from file in
/proc/<pid>/cmdline
less often and preserve cmdline or any otherinfo about process for the events that came when process is already gone.
Differential Revision: D14424352