PANTAW COLLECTOR · SYSTEM

process collector

Discover running processes and normalize their current state.

Source and collected facts

Three fixed read-only ps queries merged by PID through the shared command helper.

PID and PPID
UID and user
state, name and executable
CPU and memory percentages
start time and zombie detection

Observation contract

Usable processes are emitted in numeric PID order. Zombie and dead states are FAILURE warnings; unknown state is PARTIAL; unavailable discovery is UNAVAILABLE.

Relevant ReasonCode values: PROCESS_OBSERVED, PROCESS_ZOMBIE, PROCESS_DEAD, PROCESS_STATE_UNKNOWN, INTERNAL_ERROR

All collectors use structured ObservationStatus values and retain unavailable optional fields explicitly.

Graceful unavailability and limits

Processes may exit between discovery and enrichment. Optional fields remain explicitly unavailable instead of removing the process.

Permissions and privacy

Permissions. Visibility follows procfs and ps permissions for the runtime account.

Privacy. Process owners and executable paths may be sensitive. Full argument vectors and unrestricted process-list output are not retained.

Sanitized example

{
  "source": "process",
  "status": "SUCCESS",
  "severity": "INFO",
  "reason_code": "PROCESS_OBSERVED",
  "target": "pid:1200",
  "metadata": {"pid":1200,"ppid":1,"user":"service-user","process_status":"RUNNING","is_zombie":false}
}

Synthetic example. It is not production node data.