Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
process_open_files
process_open_files
File descriptors for each process.
| Column | Type | Description |
|---|---|---|
| fd | bigint | Process-specific file descriptor number |
| path | text | Filesystem path of descriptor |
| pid | bigint | Process (or thread) ID |
Example
See what processes have which files open, for example, what processes are currently interacting with files with 1Password in their name?
SELECT f.path file_path, p.path process_path FROM process_open_files f JOIN processes p ON p.pid = f.pid WHERE f.path LIKE '%1Password%';
Edit page
Ask us anything
Questions?
SOC2 Type 2
© 2025 Fleet Inc.
Privacy
