Add process collector #24
Conversation
- New collector to retrieve info on the top processes running, in a format that is compatible with the legacy `processes` check of the agent. Supports Linux and OS X for now. - Flags to select/exclude the collectors to run
| } | ||
|
|
||
| var options struct { | ||
| var options = struct { | ||
| only SelectedCollectors |
The logic is: kernel process == process that doesn't have PID 1 as ancestor
|
|
||
| // Name processes "kernel" if they're a kernel thread | ||
| func postProcess(processInfos []*ProcessInfo) { | ||
| pidHash := buildPIDHash(processInfos) |
There was a problem hiding this comment.
Because the processInfo's are not precisely a snapshot of the process table due to the fact that while we iterate the table to get the info - this table might change, I'm therefore (quite mildly) concerned that it could leave a slightly tainted table that wouldn't always lead to 1 or what would be worse some weird loop.
We could maybe add a maximum depth isKernelThread might go before deciding it's NOT a kernel thread. In general kernel threads would have a depth of 2 maximum. I'm sure if we go 4 or 5 levels into the recursion we can be certain it's not a kernel thread.
There was a problem hiding this comment.
Thanks, hadn't thought about that.
Addressed this by adding a recursion limit, let me know what you think.
|
👍 |
that is compatible with the legacy
processescheck of the agent.Supports Linux and OS X for now.