An operating system process.
| Attribute | Type | Description | Examples | Stability |
|---|---|---|---|---|
process.args_count |
int | Length of the process.command_args array [1] | 4 |
 |
process.command |
string | The command used to launch the process (i.e. the command name). On Linux based systems, can be set to the zeroth string in proc/[pid]/cmdline. On Windows, can be set to the first parameter extracted from GetCommandLineW. |
cmd/otelcol |
|
process.command_args |
string[] | All the command arguments (including the command/executable itself) as received by the process. On Linux-based systems (and some other Unixoid systems supporting procfs), can be set according to the list of null-delimited strings extracted from proc/[pid]/cmdline. For libc-based executables, this would be the full argv vector passed to main. |
["cmd/otecol", "--config=config.yaml"] |
|
process.command_line |
string | The full command used to launch the process as a single string representing the full command. On Windows, can be set to the result of GetCommandLineW. Do not set this if you have to assemble it just for monitoring; use process.command_args instead. |
C:\cmd\otecol --config="my directory\config.yaml" |
|
process.context_switch_type |
string | Specifies whether the context switches for this data point were voluntary or involuntary. | voluntary; involuntary |
|
process.creation.time |
string | The date and time the process was created, in ISO 8601 format. | 2023-11-21T09:25:34.853Z |
|
process.executable.build_id.gnu |
string | The GNU build ID as found in the .note.gnu.build-id ELF section (hex string). |
c89b11207f6479603b0d49bf291c092c2b719293 |
|
process.executable.build_id.go |
string | The Go build ID as retrieved by go tool buildid <go executable>. |
foh3mEXu7BLZjsN9pOwG/kATcXlYVCDEFouRMQed_/WwRFB1hPo9LBkekthSPG/x8hMC8emW2cCjXD0_1aY |
|
process.executable.build_id.htlhash |
string | Profiling specific build ID for executables. See the OTel specification for Profiles for more information. | 600DCAFE4A110000F2BF38C493F5FB92 |
|
process.executable.name |
string | The name of the process executable. On Linux based systems, this SHOULD be set to the base name of the target of /proc/[pid]/exe. On Windows, this SHOULD be set to the base name of GetProcessImageFileNameW. |
otelcol |
|
process.executable.path |
string | The full path to the process executable. On Linux based systems, can be set to the target of proc/[pid]/exe. On Windows, can be set to the result of GetProcessImageFileNameW. |
/usr/bin/cmd/otelcol |
|
process.exit.code |
int | The exit code of the process. | 127 |
|
process.exit.time |
string | The date and time the process exited, in ISO 8601 format. | 2023-11-21T09:26:12.315Z |
|
process.group_leader.pid |
int | The PID of the process's group leader. This is also the process group ID (PGID) of the process. | 23 |
|
process.interactive |
boolean | Whether the process is connected to an interactive shell. | |
|
process.owner |
string | The username of the user that owns the process. | root |
|
process.paging.fault_type |
string | The type of page fault for this data point. Type major is for major/hard page faults, and minor is for minor/soft page faults. |
major; minor |
|
process.parent_pid |
int | Parent Process identifier (PPID). | 111 |
|
process.pid |
int | Process identifier (PID). | 1234 |
|
process.real_user.id |
int | The real user ID (RUID) of the process. | 1000 |
|
process.real_user.name |
string | The username of the real user of the process. | operator |
|
process.runtime.description |
string | An additional description about the runtime of the process, for example a specific vendor customization of the runtime environment. | Eclipse OpenJ9 Eclipse OpenJ9 VM openj9-0.21.0 |
|
process.runtime.name |
string | The name of the runtime of this process. | OpenJDK Runtime Environment |
|
process.runtime.version |
string | The version of the runtime of this process, as returned by the runtime without modification. | 14.0.2 |
|
process.saved_user.id |
int | The saved user ID (SUID) of the process. | 1002 |
|
process.saved_user.name |
string | The username of the saved user. | operator |
|
process.session_leader.pid |
int | The PID of the process's session leader. This is also the session ID (SID) of the process. | 14 |
|
process.title |
string | Process title (proctitle) [2] | cat /etc/hostname; xfce4-session; bash |
|
process.user.id |
int | The effective user ID (EUID) of the process. | 1001 |
|
process.user.name |
string | The username of the effective user of the process. | root |
|
process.vpid |
int | Virtual process identifier. [3] | 12 |
|
process.working_directory |
string | The working directory of the process. | /root |
|
[1] process.args_count: This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.
[2] process.title: In many Unix-like systems, process title (proctitle), is the string that represents the name or command line of a running process, displayed by system monitoring tools like ps, top, and htop.
[3] process.vpid: The process ID within a PID namespace. This is not necessarily unique across all processes on the host but it is unique within the process namespace that the process exists within.
process.context_switch_type has the following list of well-known values. If one of them applies, then the respective value MUST be used; otherwise, a custom value MAY be used.
| Value | Description | Stability |
|---|---|---|
involuntary |
involuntary | |
voluntary |
voluntary | |
process.paging.fault_type has the following list of well-known values. If one of them applies, then the respective value MUST be used; otherwise, a custom value MAY be used.
| Value | Description | Stability |
|---|---|---|
major |
major | |
minor |
minor | |
Describes Linux Process attributes
| Attribute | Type | Description | Examples | Stability |
|---|---|---|---|---|
process.linux.cgroup |
string | The control group associated with the process. [4] | 1:name=systemd:/user.slice/user-1000.slice/session-3.scope; 0::/user.slice/user-1000.slice/user@1000.service/tmux-spawn-0267755b-4639-4a27-90ed-f19f88e53748.scope |
|
[4] process.linux.cgroup: Control groups (cgroups) are a kernel feature used to organize and manage process resources. This attribute provides the path(s) to the cgroup(s) associated with the process, which should match the contents of the /proc/[PID]/cgroup file.
Deprecated process attributes.
| Attribute | Type | Description | Examples | Stability |
|---|---|---|---|---|
process.cpu.state |
string | Deprecated, use cpu.mode instead. |
system; user; wait |
 Replaced by cpu.mode |
process.executable.build_id.profiling |
string | "Deprecated, use process.executable.build_id.htlhash instead." |
600DCAFE4A110000F2BF38C493F5FB92 |
Replaced by process.executable.build_id.htlhash |
process.cpu.state has the following list of well-known values. If one of them applies, then the respective value MUST be used; otherwise, a custom value MAY be used.
| Value | Description | Stability |
|---|---|---|
system |
system | |
user |
user | |
wait |
wait | |