Process

Process Attributes

An operating system process.

AttributeTypeDescriptionExamplesStability
process.args_countintLength of the process.command_args array [1]4Experimental
process.commandstringThe command used to launch the process (i.e. the command name). On Linux based systems, can be set to the zeroth string in proc/[pid]/cmdline. On Windows, can be set to the first parameter extracted from GetCommandLineW.cmd/otelcolExperimental
process.command_argsstring[]All the command arguments (including the command/executable itself) as received by the process. On Linux-based systems (and some other Unixoid systems supporting procfs), can be set according to the list of null-delimited strings extracted from proc/[pid]/cmdline. For libc-based executables, this would be the full argv vector passed to main.["cmd/otecol", "--config=config.yaml"]Experimental
process.command_linestringThe full command used to launch the process as a single string representing the full command. On Windows, can be set to the result of GetCommandLineW. Do not set this if you have to assemble it just for monitoring; use process.command_args instead.C:\cmd\otecol --config="my directory\config.yaml"Experimental
process.context_switch_typestringSpecifies whether the context switches for this data point were voluntary or involuntary.voluntary; involuntaryExperimental
process.creation.timestringThe date and time the process was created, in ISO 8601 format.2023-11-21T09:25:34.853ZExperimental
process.executable.build_id.gnustringThe GNU build ID as found in the .note.gnu.build-id ELF section (hex string).c89b11207f6479603b0d49bf291c092c2b719293Experimental
process.executable.build_id.gostringThe Go build ID as retrieved by go tool buildid <go executable>.foh3mEXu7BLZjsN9pOwG/kATcXlYVCDEFouRMQed_/WwRFB1hPo9LBkekthSPG/x8hMC8emW2cCjXD0_1aYExperimental
process.executable.build_id.profilingstringProfiling specific build ID for executables. See the OTel specification for Profiles for more information.600DCAFE4A110000F2BF38C493F5FB92Experimental
process.executable.namestringThe name of the process executable. On Linux based systems, can be set to the Name in proc/[pid]/status. On Windows, can be set to the base name of GetProcessImageFileNameW.otelcolExperimental
process.executable.pathstringThe full path to the process executable. On Linux based systems, can be set to the target of proc/[pid]/exe. On Windows, can be set to the result of GetProcessImageFileNameW./usr/bin/cmd/otelcolExperimental
process.exit.codeintThe exit code of the process.127Experimental
process.exit.timestringThe date and time the process exited, in ISO 8601 format.2023-11-21T09:26:12.315ZExperimental
process.group_leader.pidintThe PID of the process’s group leader. This is also the process group ID (PGID) of the process.23Experimental
process.interactivebooleanWhether the process is connected to an interactive shell.Experimental
process.ownerstringThe username of the user that owns the process.rootExperimental
process.paging.fault_typestringThe type of page fault for this data point. Type major is for major/hard page faults, and minor is for minor/soft page faults.major; minorExperimental
process.parent_pidintParent Process identifier (PPID).111Experimental
process.pidintProcess identifier (PID).1234Experimental
process.real_user.idintThe real user ID (RUID) of the process.1000Experimental
process.real_user.namestringThe username of the real user of the process.operatorExperimental
process.runtime.descriptionstringAn additional description about the runtime of the process, for example a specific vendor customization of the runtime environment.Eclipse OpenJ9 Eclipse OpenJ9 VM openj9-0.21.0Experimental
process.runtime.namestringThe name of the runtime of this process.OpenJDK Runtime EnvironmentExperimental
process.runtime.versionstringThe version of the runtime of this process, as returned by the runtime without modification.14.0.2Experimental
process.saved_user.idintThe saved user ID (SUID) of the process.1002Experimental
process.saved_user.namestringThe username of the saved user.operatorExperimental
process.session_leader.pidintThe PID of the process’s session leader. This is also the session ID (SID) of the process.14Experimental
process.titlestringProcess title (proctitle) [2]cat /etc/hostname; xfce4-session; bashExperimental
process.user.idintThe effective user ID (EUID) of the process.1001Experimental
process.user.namestringThe username of the effective user of the process.rootExperimental
process.vpidintVirtual process identifier. [3]12Experimental
process.working_directorystringThe working directory of the process./rootExperimental

[1]: This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.

[2]: In many Unix-like systems, process title (proctitle), is the string that represents the name or command line of a running process, displayed by system monitoring tools like ps, top, and htop.

[3]: The process ID within a PID namespace. This is not necessarily unique across all processes on the host but it is unique within the process namespace that the process exists within.

process.context_switch_type has the following list of well-known values. If one of them applies, then the respective value MUST be used; otherwise, a custom value MAY be used.

ValueDescriptionStability
involuntaryinvoluntaryExperimental
voluntaryvoluntaryExperimental

process.paging.fault_type has the following list of well-known values. If one of them applies, then the respective value MUST be used; otherwise, a custom value MAY be used.

ValueDescriptionStability
majormajorExperimental
minorminorExperimental

Deprecated Process Attributes

Deprecated process attributes.

AttributeTypeDescriptionExamplesStability
process.cpu.statestringDeprecated, use cpu.mode instead.system; user; waitDeprecated
Replaced by cpu.mode

process.cpu.state has the following list of well-known values. If one of them applies, then the respective value MUST be used; otherwise, a custom value MAY be used.

ValueDescriptionStability
systemsystemExperimental
useruserExperimental
waitwaitExperimental