process.name is truncated when running system module on mac

[kaiyan-sheng]

When working on system.process metricset on mac os, I see some of the process names are truncated. For example:

• Version: master branch
• Operating System: mac os
• Discuss Forum URL: https://discuss.elastic.co/t/process-name-incomplete/250804

I don't see a limit set in ECS process field documentation so I suspect the problem might be in Go sigar. This will need more investigation on different operating systems.

[elasticmachine]

Pinging @elastic/integrations (Team:Integrations)

[fearful-symmetry]

Digging into this. The C API we're accessing returns data via this struct: https://github.com/apple/darwin-xnu/blob/a449c6a3b8014d9406c2ddbdc81795da24aa7443/bsd/sys/proc_info.h#L63

The name field we're accessing is in this field:

char			pbi_comm[MAXCOMLEN];

Here, MAXCOMLEN is set to 16: https://github.com/apple/darwin-xnu/blob/0a798f6738bc1db01281fc08ae024145e84df927/osfmk/mach/resource_monitors.h#L66

So this appears to be a limitation of the OS API we're using.

There's pbi_name, but the code implies that it could be empty:

char			pbi_name[2*MAXCOMLEN];	/* empty if no name is registered */

[jlind23]

Backlog grooming: Closing it for now until further activity.