process-audit

Process auditing identifies every running process and flags anomalies, unknown services, and suspicious activity. It lists user-owned processes and system daemons to establish a baseline, then surfaces unexpected items for rapid response.

To find high CPU usage causes, process auditing scans active processes and identifies top offenders. It flags high-CPU processes and unexpected restarts, enabling quick containment when a server slows down or behaves oddly.

Yes, process auditing works with Docker containers and PM2 services. It accesses process listing utilities like pm2, docker, and launchctl to discover running services across development and production environments for comprehensive system hygiene.

You can detect suspicious LaunchAgents using process auditing with launchctl. It identifies running system daemons and LaunchAgents, flagging unknown items against a known-good baseline to maintain security and reliability.

Process auditing classifies severity by comparing running items against a baseline of known-good processes. It requires baseline knowledge to distinguish normal services from unknown items, providing clear severity classification in structured output formats.