Skip to content

csysdig --modern-bpf does only show master pid of process in container #2184

@devZer0

Description

@devZer0

hello, i use sysdig package 0.41.4 on debian 13 with docker-ce 5:29.4.2-2debian.13trixie and containerd 2.2.3-1debian.13trixie

when i switch to container view in csysdig, i can see nginx container. if i dive into that by selecting it and press return, i can see only one nginx process, the parent/master one, but i don't see the other ones which are shown in ps -ef

# ps -ef|grep nginx
root        1589    1558  0 Mai04 ?        00:00:00 nginx: master process nginx -g daemon off;
sshd        1799    1589  0 Mai04 ?        00:00:00 nginx: worker process
sshd        1800    1589  0 Mai04 ?        00:00:00 nginx: worker process
sshd        1801    1589  0 Mai04 ?        00:00:00 nginx: worker process
sshd        1802    1589  0 Mai04 ?        00:00:00 nginx: worker process
root     2299872 2299670  0 23:21 pts/3    00:00:00 grep nginx

when i docker exec into the container, the shell process is shown , but still only one nginx process is shown

Viewing: Processes For: container.id="afdc489334b2"
Source: Live System Filter: (((container.name != host) and container.id="afdc489334b2")) and (evt.type!=switch)
   PID   PPID    VPID     CPU USER          TH     VIRT      RES    FILE     NET CONTAINER           Command
  1589   1558       1    0.00 root           1      10M       6M       0    0.00 nginx               nginx: master process nginx -g daemon off;
229989   1558      86    0.00 root           1       2M       1M       0    0.00 nginx               /bin/sh

but you can see there are multiple nginx processes:

root@docker-external:~# docker exec -it afdc489334b2 ps -ef
PID   USER     TIME  COMMAND
    1 root      0:00 nginx: master process nginx -g daemon off;
   29 nginx     0:00 nginx: worker process
   30 nginx     0:00 nginx: worker process
   31 nginx     0:00 nginx: worker process
   32 nginx     0:00 nginx: worker process
   92 root      0:00 ps -ef

how can i make csysdig show all of them in container drilldown view ?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions