# Bug for PR 749

**URL:** <https://discuss.elastic.co/t/bug-for-pr-749/39921>\
**Category:** Beats\
**Created:** [January 22, 2016, 7:31pm UTC](https://discuss.elastic.co/t/bug-for-pr-749/39921 "2016-01-22T19:31:56Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![biswajit86](https://avatars.discourse-cdn.com/v4/letter/b/f17d59/32.png) [@biswajit86](https://discuss.elastic.co/u/biswajit86)\
**Post date:** [January 22, 2016, 7:31pm UTC](https://discuss.elastic.co/t/bug-for-pr-749/39921/1 "2016-01-22T19:31:56Z")

</div>

Hi All,

[PR 749](https://github.com/elastic/beats/pull/749) recently got merged to master . This PR implements support for command line options in topbeat.

However, I am unable to see command line options for `child` proceses. Some of our ancient perl scripts use ForkManager to fork child processes. In such cases, I do not see any value populated in command line options

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [January 22, 2016, 7:46pm UTC](https://discuss.elastic.co/t/bug-for-pr-749/39921/2 "2016-01-22T19:46:13Z")

</div>

What operating system are you running Topbeat on?

For my own sanity let me document how each OS works from looking at the source code in gosigar:

- Windows - A WMI query is performed using the PID. In PowerShell you can do the query with: `Get-WmiObject -Query "SELECT CommandLine from Win32_Process where ProcessID = <PID>"`. The same information is also visible in the Task Manager if you add Command Line as a column.
- Linux - It reads the values from `/proc/<pid>/cmdline`. In a shell you can get the data with `cat /proc/<pid>/cmdline`
- Mac OS X - It uses sysctl to get the process info.

---

<div class="post-metadata">

**Author:** ![biswajit86](https://avatars.discourse-cdn.com/v4/letter/b/f17d59/32.png) [@biswajit86](https://discuss.elastic.co/u/biswajit86)\
**Post date:** [January 22, 2016, 8:14pm UTC](https://discuss.elastic.co/t/bug-for-pr-749/39921/3 "2016-01-22T20:14:52Z")

</div>

I am running on RHEL 5.11

For the child proccesses, I see the `proc.state` value populated as `zombie`

Also, I do see the value in /proc//cmdline file.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [January 22, 2016, 8:52pm UTC](https://discuss.elastic.co/t/bug-for-pr-749/39921/4 "2016-01-22T20:52:04Z")

</div>

So you have events where `proc.state` is `zombie` and `proc.cmdline` does not exist? Or is `proc.cmdline` present and set to an blank value? And for the same process, if you run `cat /proc/<pid>/cmdline` you see the command?

---

<div class="post-metadata">

**Author:** ![biswajit86](https://avatars.discourse-cdn.com/v4/letter/b/f17d59/32.png) [@biswajit86](https://discuss.elastic.co/u/biswajit86)\
**Post date:** [January 22, 2016, 9:20pm UTC](https://discuss.elastic.co/t/bug-for-pr-749/39921/5 "2016-01-22T21:20:00Z")

</div>

- proc.cmdline does not exists
- if I cat /proc//cmdline, I `do` see the commandline arguments in full

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:56pm UTC](https://discuss.elastic.co/t/bug-for-pr-749/39921/6 "2017-07-05T21:56:27Z")

</div>