Skip to content

csysdig --modern-bpf does only show master pid of process in container #2184

@devZer0

Description

@devZer0

hello, i use sysdig package 0.41.4 on debian 13 with docker-ce 5:29.4.2-2debian.13trixie and containerd 2.2.3-1debian.13trixie

when i switch to container view in csysdig, i can see nginx container. if i dive into that by selecting it and press return, i can see only one nginx process, the parent/master one, but i don't see the other ones which are shown in ps -ef

# ps -ef|grep nginx
root        1589    1558  0 Mai04 ?        00:00:00 nginx: master process nginx -g daemon off;
sshd        1799    1589  0 Mai04 ?        00:00:00 nginx: worker process
sshd        1800    1589  0 Mai04 ?        00:00:00 nginx: worker process
sshd        1801    1589  0 Mai04 ?        00:00:00 nginx: worker process
sshd        1802    1589  0 Mai04 ?        00:00:00 nginx: worker process
root     2299872 2299670  0 23:21 pts/3    00:00:00 grep nginx

when i docker exec into the container, the shell process is shown , but still only one nginx process is shown

Viewing: Processes For: container.id="afdc489334b2"
Source: Live System Filter: (((container.name != host) and container.id="afdc489334b2")) and (evt.type!=switch)
   PID   PPID    VPID     CPU USER          TH     VIRT      RES    FILE     NET CONTAINER           Command
  1589   1558       1    0.00 root           1      10M       6M       0    0.00 nginx               nginx: master process nginx -g daemon off;
229989   1558      86    0.00 root           1       2M       1M       0    0.00 nginx               /bin/sh

but you can see there are multiple nginx processes:

root@docker-external:~# docker exec -it afdc489334b2 ps -ef
PID   USER     TIME  COMMAND
    1 root      0:00 nginx: master process nginx -g daemon off;
   29 nginx     0:00 nginx: worker process
   30 nginx     0:00 nginx: worker process
   31 nginx     0:00 nginx: worker process
   32 nginx     0:00 nginx: worker process
   92 root      0:00 ps -ef

how can i make csysdig show all of them in container drilldown view ?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions