Is your feature request related to a problem? Please describe.
Currently very short lived processes seem to be missed as the cgroup/pid is not joined at the initial event. Thus later attribution can be hard.
Describe the solution you'd like
I want to work on the most efficient solution to resolve either a longer lived ppid or find a robust mechanism to ensure meta-data of a short-lived process can be attributed at all cases (that have meta-data in the first place)
Describe alternatives you've considered
Currently using an external information to reconstruct the process tree. This works, but is highly inefficient.
Additional context
I will take this issue myself but open it here under the main repo, for better visibility
Is your feature request related to a problem? Please describe.
Currently very short lived processes seem to be missed as the cgroup/pid is not joined at the initial event. Thus later attribution can be hard.
Describe the solution you'd like
I want to work on the most efficient solution to resolve either a longer lived ppid or find a robust mechanism to ensure meta-data of a short-lived process can be attributed at all cases (that have meta-data in the first place)
Describe alternatives you've considered
Currently using an external information to reconstruct the process tree. This works, but is highly inefficient.
Additional context
I will take this issue myself but open it here under the main repo, for better visibility