Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

system/process on windows needs to better filter for processes it can't monitor #30660

Closed
fearful-symmetry opened this issue Mar 2, 2022 · 4 comments
Labels
bug Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team

Comments

@fearful-symmetry
Copy link
Contributor

Filing this issue since I'm not a windows person, and I'd probably need some help fixing parts of it. Also shout out to @bjmcnic for his help here.

I've been able to reproduce a number of awkward error messages for system/process under windows, usually error getting process mem for pid and Could not fetch info for PID, all the errors thrown for a variety of PIDs. After some digging, it looks like there's a few different issues going on here:

  • OpenProcess when called with a PROCESS_VM_READ flag, will fail when run against privileged system processes.
  • OpenProcess calls to fetch metrics from elastic-agent.exe are failing due to the use of PPL by Agent and Endpoint.

Elegant fixes for these issues will require someone with window systems knowledge, and PPL is a can of worms in its own right. Until then, we should at least make the system/process collection on windows a little more intelligent when it comes to failing on processes that we know ahead of time it can't monitor. PIDs 0 and 4 behave in certain weird ways, but we don't have any filter logic here to at least skip over API calls for those PIDs when we know they fail. Similarly, we might want to skip over Permission Denied errors for processes that we know belong to windows services.

@fearful-symmetry fearful-symmetry added bug Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team labels Mar 2, 2022
@elasticmachine
Copy link
Collaborator

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

@softengchick
Copy link

#17314

@cmacknz
Copy link
Member

cmacknz commented Jan 17, 2023

Per #17314 (comment) go-sysinfo already handles much of this. I think this is another argument for both switching to go-sysinfo instead of gosigar, and also merging the elastic-system-metrics-package with go-sysinfo elastic/elastic-agent-system-metrics#51

@cmacknz
Copy link
Member

cmacknz commented Nov 22, 2023

I think we can close this now that #17314 is fixed

@cmacknz cmacknz closed this as completed Nov 22, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team
Projects
None yet
Development

No branches or pull requests

4 participants