Bug for PR 749

Elastic Stack Beats
1

Hi All,

PR 749 recently got merged to master . This PR implements support for command line options in topbeat.

However, I am unable to see command line options for child proceses. Some of our ancient perl scripts use ForkManager to fork child processes. In such cases, I do not see any value populated in command line options

2

What operating system are you running Topbeat on?

For my own sanity let me document how each OS works from looking at the source code in gosigar:

  • Windows - A WMI query is performed using the PID. In PowerShell you can do the query with: Get-WmiObject -Query "SELECT CommandLine from Win32_Process where ProcessID = <PID>". The same information is also visible in the Task Manager if you add Command Line as a column.
  • Linux - It reads the values from /proc/<pid>/cmdline. In a shell you can get the data with cat /proc/<pid>/cmdline
  • Mac OS X - It uses sysctl to get the process info.
3

I am running on RHEL 5.11

For the child proccesses, I see the proc.state value populated as zombie

Also, I do see the value in /proc//cmdline file.

4

So you have events where proc.state is zombie and proc.cmdline does not exist? Or is proc.cmdline present and set to an blank value? And for the same process, if you run cat /proc/<pid>/cmdline you see the command?

5
  • proc.cmdline does not exists
  • if I cat /proc//cmdline, I do see the commandline arguments in full