Beats: Metricbeat process module cmdline does not update even though process alters it

[eldondevcg]

• Version: 5.1.2
• Operating System: Linux 4.8.0-41-generic 44~16.04.1-Ubuntu SMP
• Steps to Reproduce:
  
  
  
  • Start MetricBeat
  
  
  • Cause process to alter command line to change the results reported by ps and other tools
  
  
  • MetricBeat continues to report old cmdline.
  
  

It is not uncommon1 2 3 for some linux tools to modify /proc/cmdline contents to make monitoring tools more intelligible, and sometimes to add status information about a process, such as "sleeping", "idle", "running", etc.
Unfortunately, metricbeats seems to cache this information. I think it would be preferable not to cache this information at all, but at the very least an option to avoid caching it would be nice.

[tsg]

I think we added the cache due to performance issues on Windows. It makes sense to me to add an option to disable it.

[tsg]

Or even make it default off on non-Windows.

[martinscholz83]

Hi @tsg. I think it is this line where you cache the cmdline, right?

[andrewkroh]

@maddin2016 Yeah, that is where the grabs the cached cmdline. And this is where it skips the fetching if it already knows the cmdline.

[martinscholz83]

What about an option process.cmdline.cache: true ?

[ruflin]

I somehow dislike different behaviour on different OS so I think a config option would work best here.

[eldondevcg]

I would be happy with a config option.

[martinscholz83]

If everyone is happy with a config option I would adopt this issue.

[tsg]

Thanks @maddin2016!