# Parent process sometimes missing **URL:** \ **Category:** Beats\ **Tags:** auditbeat\ **Created:** [September 16, 2019, 11:55am UTC](https://discuss.elastic.co/t/parent-process-sometimes-missing/199652 "2019-09-16T11:55:55Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![vaclav](https://avatars.discourse-cdn.com/v4/letter/v/34f0e0/32.png) [@vaclav](https://discuss.elastic.co/u/vaclav)\ **Post date:** [September 16, 2019, 11:55am UTC](https://discuss.elastic.co/t/parent-process-sometimes-missing/199652/1 "2019-09-16T11:55:55Z")
Hello, I am using this processor to get information about process parent: - add\_process\_metadata: match\_pids: [process.ppid] target: process.parent but sometimes is parent process missing in auditbeat messages I found this issues for processes started from crontab, but looks like there also other processes without parent. Do you please know why is parent process missing or how to investigate this issue ? Thanks Regards ---
**Author:** ![cwurm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cwurm/32/34882_2.png) [@cwurm](https://discuss.elastic.co/u/cwurm)\ **Post date:** [September 17, 2019, 11:08am UTC](https://discuss.elastic.co/t/parent-process-sometimes-missing/199652/2 "2019-09-17T11:08:41Z")
Most likely this is due to the process having exited by the time the processor is called. Many processes are very short-lived. If you turn on debug logging (`./auditbeat -e -d "*"`) you should be seeing messages starting with `failed to get process metadata for PID=`. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 8, 2019, 11:08am UTC](https://discuss.elastic.co/t/parent-process-sometimes-missing/199652/3 "2019-10-08T11:08:44Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.