PR 749 recently got merged to master . This PR implements support for command line options in topbeat.
However, I am unable to see command line options for
child proceses. Some of our ancient perl scripts use ForkManager to fork child processes. In such cases, I do not see any value populated in command line options
What operating system are you running Topbeat on?
For my own sanity let me document how each OS works from looking at the source code in gosigar:
- Windows - A WMI query is performed using the PID. In PowerShell you can do the query with:
Get-WmiObject -Query "SELECT CommandLine from Win32_Process where ProcessID = <PID>". The same information is also visible in the Task Manager if you add Command Line as a column.
- Linux - It reads the values from
/proc/<pid>/cmdline. In a shell you can get the data with
- Mac OS X - It uses sysctl to get the process info.
I am running on RHEL 5.11
For the child proccesses, I see the
proc.state value populated as
Also, I do see the value in /proc//cmdline file.
So you have events where
proc.cmdline does not exist? Or is
proc.cmdline present and set to an blank value? And for the same process, if you run
cat /proc/<pid>/cmdline you see the command?