procstat on Linux does not report remote users

[golobart]

Hi,
I use procstat input to get several data about resources consumption by processes and users .
There is no problem to get all that data when the users owning the processes are Linux local users; however, when the process owner users are not local, Telegraf sends user tag empty.

By not local I mean remote users defined in an Active Directory, which a kerberized Linux machine uses to authenticate the users.

How can I get the user tag populated with the remote username?

I've tried Telegraf v 1.28 and 1.33 and in both cases I've got the same result -> user is empty

Our procstat config is like this:

[[inputs.procstat]]
pattern = "xxxxxx"
pid_tag = true

many thanks!!

[Hr0bar]

Just some background why it behaves like that:
Seems inputs.procstat uses https://github.com/shirou/gopsutil, which simply calls built-in os.user here:

https://github.com/shirou/gopsutil/blob/master/process/process_posix.go#L174

os.user fetches it here depending on platform:
https://cs.opensource.google/go/go/+/refs/tags/go1.24.1:src/os/user/lookup.go;l=48

but for linux it seems it uses

const (
	userFile  = "/etc/passwd"
	groupFile = "/etc/group"
)

and just checks those files:

func lookupUserId(uid string) (*User, error) {
	f, err := os.Open(userFile)
	if err != nil {
		return nil, err
	}
	defer f.Close()
	return findUserId(uid, f)
}

[srebhan]

@golobart as @Hr0bar outlined this is an issue in Golang itself as it can only access the local users in /etc/passwd if not compiled with CGO (which we disable for static builds). However, what I can offer is to output the UID instead of leaving the user empty. We then might be able to provide a processor (or simply use the exec processor) to resolve the UID to a name given the expected authentication source (e.g. LDAP)...

[golobart]

@Hr0bar and @srebhan thank you both for your fast and useful answers.
To have at least the UID would be a better solution than an empty user.

How can we proceed with it? will you provide it in the next Telegraf version?

[WorksAtAUni]

same issue here, we are AD and SSSD and those files are empty, working around it with a script for some linux systems I need to track. Toss up between inputs.tail and inputs.execd... leaning toward inputs since I can easily add some filtering login there.

[srebhan]

@golobart, @Hr0bar and @WorksAtAUni please test the binary in PR #16986, available as soon as CI finished the tests, and let me know if this solves the issue for you!

[WorksAtAUni]

Will do, it will be a couple of days after until I can get to ot myself...

[golobart]

Many thanks for your answer, I've downloaded the binaries and will test in the next days, after security people say go

[golobart]

Hi,
after some tests I don't get the desired results, I mean:

using this configuration in telegraf.conf:
[[inputs.procstat]]
pattern = "abcd"
tag_with = ["pid","user"]

only local users are reported, remote users don't

If I try this config:
[[inputs.procstat.filter]]
patterns = ['.*abcd.*']
users = ['*']

Telegraf just do not start

Should I change something in the config file?

"id" exists as Linux command in the machine

[WorksAtAUni]

Thanks for the prompt... I did not seem to be getting the data either, but we use Sumo logic for their metrics app and had set aside some time to see if it was the config, or the metrics app itself. But not really "dropping" that metric in the config.

[srebhan]

@golobart and @WorksAtAUni, please test again with the latest binary in the PR! I had some error in the implementation... Should work now...

[golobart]

got new version, testing...

[WorksAtAUni]

I'll be able to sneak this on next week... finger-crossed.