diff --git a/.chloggen/update-process-executable-build_id-htlhash-description-generic.yaml b/.chloggen/update-process-executable-build_id-htlhash-description-generic.yaml new file mode 100644 index 0000000000..e5ec04fa80 --- /dev/null +++ b/.chloggen/update-process-executable-build_id-htlhash-description-generic.yaml @@ -0,0 +1,22 @@ +# Use this changelog template to create an entry for release notes. +# +# If your change doesn't affect end users you should instead start +# your pull request title with [chore] or use the "Skip Changelog" label. + +# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix' +change_type: enhancement + +# The name of the area of concern in the attributes-registry, (e.g. http, cloud, db) +component: process + +# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`). +note: Update process.executable.build_id.htlhash description to be generic + +# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists. +# The values here must be integers. +issues: [3563] + +# (Optional) One or more lines of additional information to render under the primary note. +# These lines will be padded with 2 spaces and then inserted directly into the document. +# Use pipe (|) for multiline entries. +subtext: diff --git a/docs/registry/attributes/process.md b/docs/registry/attributes/process.md index fc28defa57..74b11dad67 100644 --- a/docs/registry/attributes/process.md +++ b/docs/registry/attributes/process.md @@ -24,7 +24,7 @@ An operating system process. | `process.environment_variable.` | ![Development](https://img.shields.io/badge/-development-blue) | string | Process environment variables, `` being the environment variable name, the value being the environment variable value. [2] | `ubuntu`; `/usr/local/bin:/usr/bin` | | `process.executable.build_id.gnu` | ![Development](https://img.shields.io/badge/-development-blue) | string | The GNU build ID as found in the `.note.gnu.build-id` ELF section (hex string). | `c89b11207f6479603b0d49bf291c092c2b719293` | | `process.executable.build_id.go` | ![Development](https://img.shields.io/badge/-development-blue) | string | The Go build ID as retrieved by `go tool buildid `. | `foh3mEXu7BLZjsN9pOwG/kATcXlYVCDEFouRMQed_/WwRFB1hPo9LBkekthSPG/x8hMC8emW2cCjXD0_1aY` | -| `process.executable.build_id.htlhash` | ![Development](https://img.shields.io/badge/-development-blue) | string | Profiling specific build ID for executables. See the OTel specification for Profiles for more information. | `600DCAFE4A110000F2BF38C493F5FB92` | +| `process.executable.build_id.htlhash` | ![Development](https://img.shields.io/badge/-development-blue) | string | Deterministic build ID for executables. [3] | `600DCAFE4A110000F2BF38C493F5FB92` | | `process.executable.name` | ![Development](https://img.shields.io/badge/-development-blue) | string | The name of the process executable. On Linux based systems, this SHOULD be set to the base name of the target of `/proc/[pid]/exe`. On Windows, this SHOULD be set to the base name of `GetProcessImageFileNameW`. | `otelcol` | | `process.executable.path` | ![Development](https://img.shields.io/badge/-development-blue) | string | The full path to the process executable. On Linux based systems, can be set to the target of `proc/[pid]/exe`. On Windows, can be set to the result of `GetProcessImageFileNameW`. | `/usr/bin/cmd/otelcol` | | `process.exit.code` | ![Development](https://img.shields.io/badge/-development-blue) | int | The exit code of the process. | `127` | @@ -43,10 +43,10 @@ An operating system process. | `process.saved_user.name` | ![Development](https://img.shields.io/badge/-development-blue) | string | The username of the saved user. | `operator` | | `process.session_leader.pid` | ![Development](https://img.shields.io/badge/-development-blue) | int | The PID of the process's session leader. This is also the session ID (SID) of the process. | `14` | | `process.state` | ![Development](https://img.shields.io/badge/-development-blue) | string | The process state, e.g., [Linux Process State Codes](https://man7.org/linux/man-pages/man1/ps.1.html#PROCESS_STATE_CODES) | `running` | -| `process.title` | ![Development](https://img.shields.io/badge/-development-blue) | string | Process title (proctitle) [3] | `cat /etc/hostname`; `xfce4-session`; `bash` | +| `process.title` | ![Development](https://img.shields.io/badge/-development-blue) | string | Process title (proctitle) [4] | `cat /etc/hostname`; `xfce4-session`; `bash` | | `process.user.id` | ![Development](https://img.shields.io/badge/-development-blue) | int | The effective user ID (EUID) of the process. | `1001` | | `process.user.name` | ![Development](https://img.shields.io/badge/-development-blue) | string | The username of the effective user of the process. | `root` | -| `process.vpid` | ![Development](https://img.shields.io/badge/-development-blue) | int | Virtual process identifier. [4] | `12` | +| `process.vpid` | ![Development](https://img.shields.io/badge/-development-blue) | int | Virtual process identifier. [5] | `12` | | `process.working_directory` | ![Development](https://img.shields.io/badge/-development-blue) | string | The working directory of the process. | `/root` | **[1] `process.args_count`:** This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. @@ -60,9 +60,23 @@ as the `process.environment_variable.USER` attribute with value `"ubuntu"`. SHOULD be recorded as the `process.environment_variable.PATH` attribute with value `"/usr/local/bin:/usr/bin"`. -**[3] `process.title`:** In many Unix-like systems, process title (proctitle), is the string that represents the name or command line of a running process, displayed by system monitoring tools like ps, top, and htop. +**[3] `process.executable.build_id.htlhash`:** GNU and Go build IDs may be stripped or unavailable in some environments +(e.g., Alpine Linux, Docker images). This attribute provides a deterministic +build ID computed by hashing the first and last 4096 bytes of the file +along with its length: -**[4] `process.vpid`:** The process ID within a PID namespace. This is not necessarily unique across all processes on the host but it is unique within the process namespace that the process exists within. +``` +Input ← Concat(File[:4096], File[-4096:], BigEndianUInt64(Len(File))) +Digest ← SHA256(Input) +BuildID ← Digest[:16] +``` + +The result is the first 16 bytes (128 bits) of the SHA256 digest, +represented as a hex string. + +**[4] `process.title`:** In many Unix-like systems, process title (proctitle), is the string that represents the name or command line of a running process, displayed by system monitoring tools like ps, top, and htop. + +**[5] `process.vpid`:** The process ID within a PID namespace. This is not necessarily unique across all processes on the host but it is unique within the process namespace that the process exists within. --- @@ -92,9 +106,9 @@ Describes Linux Process attributes | Key | Stability | Value Type | Description | Example Values | | --- | --- | --- | --- | --- | -| `process.linux.cgroup` | ![Development](https://img.shields.io/badge/-development-blue) | string | The control group associated with the process. [5] | `1:name=systemd:/user.slice/user-1000.slice/session-3.scope`; `0::/user.slice/user-1000.slice/user@1000.service/tmux-spawn-0267755b-4639-4a27-90ed-f19f88e53748.scope` | +| `process.linux.cgroup` | ![Development](https://img.shields.io/badge/-development-blue) | string | The control group associated with the process. [6] | `1:name=systemd:/user.slice/user-1000.slice/session-3.scope`; `0::/user.slice/user-1000.slice/user@1000.service/tmux-spawn-0267755b-4639-4a27-90ed-f19f88e53748.scope` | -**[5] `process.linux.cgroup`:** Control groups (cgroups) are a kernel feature used to organize and manage process resources. This attribute provides the path(s) to the cgroup(s) associated with the process, which should match the contents of the [/proc/\[PID\]/cgroup](https://man7.org/linux/man-pages/man7/cgroups.7.html) file. +**[6] `process.linux.cgroup`:** Control groups (cgroups) are a kernel feature used to organize and manage process resources. This attribute provides the path(s) to the cgroup(s) associated with the process, which should match the contents of the [/proc/\[PID\]/cgroup](https://man7.org/linux/man-pages/man7/cgroups.7.html) file. ## Deprecated Process Attributes diff --git a/model/process/registry.yaml b/model/process/registry.yaml index a4784dc3d0..d426200571 100644 --- a/model/process/registry.yaml +++ b/model/process/registry.yaml @@ -57,8 +57,21 @@ groups: stability: development type: string brief: > - Profiling specific build ID for executables. See the OTel specification - for Profiles for more information. + Deterministic build ID for executables. + note: | + GNU and Go build IDs may be stripped or unavailable in some environments + (e.g., Alpine Linux, Docker images). This attribute provides a deterministic + build ID computed by hashing the first and last 4096 bytes of the file + along with its length: + + ``` + Input ← Concat(File[:4096], File[-4096:], BigEndianUInt64(Len(File))) + Digest ← SHA256(Input) + BuildID ← Digest[:16] + ``` + + The result is the first 16 bytes (128 bits) of the SHA256 digest, + represented as a hex string. examples: ['600DCAFE4A110000F2BF38C493F5FB92'] - id: process.executable.name type: string