elastic/gosigar

Gathers system and per process statistics

Go sigar

Overview

Go sigar is a golang implementation of the sigar API. The Go version of sigar has a very similar interface, but is being written from scratch in pure go/cgo, rather than cgo bindings for libsigar.

Test drive

$ go get github.com/elastic/gosigar
$ cd $GOPATH/src/github.com/elastic/gosigar/examples/ps
$ go build
$ ./ps

Supported platforms

The features vary by operating system.

Feature	Linux	Darwin	Windows	OpenBSD	FreeBSD	AIX
Cpu	X	X	X	X	X	X
CpuList	X	X		X	X	X
FDUsage	X				X
FileSystemList	X	X	X	X	X	X
FileSystemUsage	X	X	X	X	X	X
HugeTLBPages	X
LoadAverage	X	X		X	X	X
Mem	X	X	X	X	X	X
ProcArgs	X	X	X		X	X
ProcEnv	X	X			X	X
ProcExe	X	X			X	X
ProcFDUsage	X				X
ProcList	X	X	X		X	X
ProcMem	X	X	X		X	X
ProcState	X	X	X		X	X
ProcTime	X	X	X		X	X
Rusage	X		X			X
Swap	X	X		X	X	X
Uptime	X	X		X	X	X

OS Specific Notes

FreeBSD

Mount both linprocfs and procfs for compatability. Consider adding these mounts to your /etc/fstab file so they are mounted automatically at boot.

sudo mount -t procfs proc /proc
sudo mkdir -p /compat/linux/proc
sudo mount -t linprocfs /dev/null /compat/linux/proc

License

Apache 2.0

gosigar's Issues

ProcStatus.Username fails on Windows XP

gosigar fails to LookupAccountSid on Windows XP. The code passes in "localhost" as the destination RPC server, but the docs say to pass in null to connect to the local machine.

Update README for FreeBSD

The table on the README was not updated for FreeBSD.

@knz would you be able to update this? If you're busy I can take care of it sometime soon. Thanks

ProcStatus.PPID value is wrong on Windows

The ppid is obtained by calling CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, <pid>) and obtaining the PPID from the first process returned by Process32First. However CreateToolhelp32Snapshot ignores the pid parameter when used with the TH32CS_SNAPPROCESS flag. It returns a snapshot of all processes and you must iterate over the processes using Process32Next.

Ref: https://msdn.microsoft.com/en-us/library/windows/desktop/ms682489(v=vs.85).aspx

FreeBSD ProcFDUsage problem

I was testing ProcFDUsage on FreeBSD and it's not able to find the /compat/linux/proc/<pid>/rlimit file. I can't find any information on this file. Does it require a certain FreeBSD version?

Is there an alternative implementation that we can use to get the number of FD's open per process?

% uname -a
FreeBSD  11.0-CURRENT FreeBSD 11.0-CURRENT #0 r294499: Thu Jan 21 15:46:19 UTC 2016     [email protected]:/usr/obj/usr/src/sys/GENERIC  amd64
vagrant@:~ % ls -la /compat/linux/proc/257/
total 0
dr-xr-xr-x  1 root  wheel  0 Aug 26 16:31 .
dr-xr-xr-x  1 root  wheel  0 Aug 26 16:31 ..
-r--r--r--  1 root  wheel  0 Aug 26 16:31 cmdline
lr--r--r--  1 root  wheel  0 Aug 26 16:31 cwd -> /
lr--r--r--  1 root  wheel  0 Aug 26 16:31 exe -> /sbin/dhclient
lr--r--r--  1 root  wheel  0 Aug 26 16:31 fd -> unknown
-r--r--r--  1 root  wheel  0 Aug 26 16:31 maps
lr--r--r--  1 root  wheel  0 Aug 26 16:31 root -> /
-r--r--r--  1 root  wheel  0 Aug 26 16:31 stat
-r--r--r--  1 root  wheel  0 Aug 26 16:31 statm
-r--r--r--  1 root  wheel  0 Aug 26 16:31 status

The procFileNameNative() function doesn't seem to be required. Instead we should use procFileName() which takes into account the different mount point used for the /proc dir on FreeBSD (which is at /compat/linux/proc).

// cc: @knz - I was hoping you might have some insight here. I can take care of any changes that are needed, but at the moment not exactly sure what changes to make.

Can not build with GOOS=freebsd

$ GOOS=freebsd go build
# github.com/elastic/gosigar
./concrete_sigar.go:55:11: m.Get undefined (type Mem has no field or method Get)
./concrete_sigar.go:67:11: p.Get undefined (type HugeTLBPages has no field or method Get)
./concrete_sigar.go:79:12: fd.Get undefined (type FDUsage has no field or method Get)
./sigar_linux_common.go:70:4: undefined: parseCpuStat
./sigar_linux_common.go:88:4: undefined: parseCpuStat
./sigar_linux_common.go:106:18: undefined: getMountTableFileName

$ go version
go version go1.20.4 linux/amd64

Memory ActualUsed should be different from Memory Used

gosigar/sigar_linux_common.go

Lines 74 to 75 in 8620c67

	self.Used = self.Total - self.ActualFree
	self.ActualUsed = self.Total - self.ActualFree

ActualUsed and Used should be different.

Rusage suppport isn't documented

When we added rusage support, we never added it to the support matrix. We should do that.

an error when trying to build an app

Hello,
I have an issue while trying to build my app in Golang It cannot be done.

karim@Karims-MacBook-Pro app % go build

github.com/elastic/gosigar

../../../go/pkg/mod/github.com/elastic/[email protected]/sigar_common_darwin.go:202:23: could not determine kind of name for C.PROC_ALL_PIDS
../../../go/pkg/mod/github.com/elastic/[email protected]/sigar_common_darwin.go:494:34: could not determine kind of name for C.PROC_PIDTASKALLINFO
../../../go/pkg/mod/github.com/elastic/[email protected]/sigar_common_darwin.go:202:7: could not determine kind of name for C.proc_listpids
../../../go/pkg/mod/github.com/elastic/[email protected]/sigar_common_darwin.go:494:7: could not determine kind of name for C.proc_pidinfo

I am using MacBook Apple silicon M3

CPU usage spike with gosigar + metricbeat (process) on FreeBSD

Hi,

I running the latest build on metricbeat on FreeBSD 10.1-REL.
As soon as activating it, specifically the process metricset - the CPU usage spikes to 40-50%.

The metricbeat devs suggest that this might be an issue with gosigar.

Please have a look at the thread here:
https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412/20

There is also a link to a pprof trace.

This is my current gosigar revision:
61dfed4

Let me know if you need anything else.

Thanks,

`go test` fails on a clean windows install

Howdy!

I'm fairly new to go so help me out if I'm completely in left field on this one.

Running a plain go test on a clean windows install of gosigar fails. I believe that this is due to platform differences between windows and *nix systems that are not accounted for in the sigar_interface_test.go and the concrete_sigar_test.go outlined in detail in this pull request: /pull/13

One example is that executables in windows need a ".exe" suffix whereas in a *nix system this need not be the case

Apologies for the rough cmd window formatting :)

←[90mC:/Projects/GoWorkspace/src/github.com/elastic/gosigar/sigar_interface_
test.go:100←[0m

  ←[91mExpected
      <[]string | len:2, cap:2>: ["go", "ginkgo"]
  to contain element matching
      <string>: go.exe←[0m

Perhaps an appveyor + travis CI server would help illuminate these types of issues by building and running tests on all environments gosigar is deployed :)

Error getting memory usage for protected processes

The following function opens a handle to a process with desired access PROCESS_QUERY_LIMITED_INFORMATION and PROCESS_VM_READ, in order to call GetProcessMemoryInfo. If the Windows version is not Vista or greater, PROCESS_QUERY_INFORMATION is used instead of PROCESS_QUERY_LIMITED_INFORMATION.

gosigar/sigar_windows.go

Lines 289 to 304 in 9d6c926

	func (self *ProcMem) Get(pid int) error {
	handle, err := syscall.OpenProcess(processQueryLimitedInfoAccess|windows.PROCESS_VM_READ, false, uint32(pid))
	if err != nil {
	return errors.Wrapf(err, "OpenProcess failed for pid=%v", pid)
	}
	defer syscall.CloseHandle(handle)
	counters, err := windows.GetProcessMemoryInfo(handle)
	if err != nil {
	return errors.Wrapf(err, "GetProcessMemoryInfo failed for pid=%v", pid)
	}
	self.Resident = uint64(counters.WorkingSetSize)
	self.Size = uint64(counters.PrivateUsage)
	return nil
	}

As stated at https://docs.microsoft.com/en-us/windows/win32/api/psapi/nf-psapi-getprocessmemoryinfo PROCESS_VM_READ is only necessary on Server 2003 / Windows XP. It is not necessary for Vista or greater.

This is problematic for protected processes, including anti-malware PPL processes. It is documented at https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights#protected-processes that a process is forbidden from opening a handle to a protected process with PROCESS_VM_READ. Therefore, the call to OpenProcess will fail. Running with SeDebugPrivilege in the process token does not bypass this restriction.

PROCESS_QUERY_LIMITED_INFORMATION is allowed, and therefore the solution is to modify this function to not request PROCESS_VM_READ if running on Vista or greater (or just remove it, if XP is no longer supported). It will then be possible to retrieve memory usage information for protected processes, including many anti-malware processes.

Further reading on AM-PPL: https://docs.microsoft.com/en-us/windows/win32/services/protecting-anti-malware-services-

Invalid class error when collecting process information in Windows 2012

Reported in https://discuss.elastic.co/t/no-data-to-display-for-the-selected-metrics/134679

When collecting process information in Windows 2012 Standard (not R2), errors like these appear and no data is collected:

2018-06-06T00:24:46.637+0530 ERROR process/process.go:454 Error getting process details. pid=620: error getting pr
ocess arguments for pid=620: ProcArgs failed for pid=620: could not get Win32_Process WHERE ProcessId = 620: Exception o
ccurred. (Invalid class )

It doesn't seem to happen in more recent versions of Windows Server (at least it doesn't happen in 2012 R2 and 2016), we already have a check for Windows Vista, maybe we need something else, although the documentation mentions that it is supported since Windows 2008.

Compilation failure when building on 32-bit windows

..\..\elastic\gosigar\sigar_windows.go:491: cannot use &availableBytes (type *C.ULARGE_INTEGER) as type *[8]byte in argument to _Cfunc_GetDiskFreeSpaceEx

Test failures when running on GitHub Windows Runners

=== RUN   TestGetDiskFreeSpaceEx
    syscall_windows_test.go:110: The device is not ready.
--- FAIL: TestGetDiskFreeSpaceEx (0.04s)

--- FAIL: TestGetVolumePathsForVolume (0.00s)
FAIL
FAIL	github.com/elastic/gosigar/sys/windows	0.161s
FAIL

I tried with windows-latest and windows-2019 with the same outcome. While the original implementation in the CI targeted windows-2012, see #171

gosigar won't build for IOS

libproc is not available in the IOS SDK. The build tags on the files could be updated to include the sigar_stub.go and exclude the darwin files to word-around the issue for any projects that use this library.

If this is pursued then the project should add a test that compiles work for

GOOS=darwin GOOS=amd64 go build .
GOOS=darwin GOOS=386 go build .
gomobile build -target=ios .

The README should also be updated to include a note about IOS.

Return ErrNotImplemented when a feature is not implemented

Most methods silently return nil when the feature is not implemented and some even panic. By returning an error, callers can test to see if the feature is implemented at runtime.

OpenBSD: (*Mem).Get() returns zero with no error

Reported in cockroachdb/cockroach#15836

Using 64-bit OpenBSD
CockroachDB calls (*Mem).Get() and that returns zero with a nil error. The zero value is incorrect; an error should be returned instead.

Implement load averages for Windows

This would help resolve elastic/beats#9944.

Currently, this method is not implemented:

gosigar/sigar_windows.go

Lines 57 to 59 in 7bed239

	func (self *LoadAverage) Get() error {
	return ErrNotImplemented{runtime.GOOS}
	}

This is likely because the analogous function in the C Sigar library is also not implemented:

https://github.com/hyperic/sigar/blob/ad47dc3b494e9293d1f087aebb099bdba832de5e/src/os/win32/win32_sigar.c#L1140-L1149

However, https://github.com/boundary/sigar, which is a fork of https://github.com/hyperic/sigar has an implementation for the above function:

https://github.com/boundary/sigar/blob/a6c61edf8c64e013411e8c9d753165cd03102c6e/src/os/win32/win32_sigar.c#L1084-L1125

Perhaps we could reference this implementation and port it over?

Related: #107

/proc/<pid>/stat file is incorrectly parsed when comm contains parentheses

I just noticed the following error when running metricbeat 6.0.0-rc1 at ubuntu linux.

2017/10/30 16:05:31.762957 process_summary.go:79: ERR Unknown state <41> for process with pid 1467

It looks like ProcState.Get(int) incorrectly assumes a process name can't include ")" and splits the content by ")" character. This results the State being ")" <41> and other entries to be garbled.

ubuntu@ip-172-31-17-129:/etc/nginx$ cat /proc/1467/stat                                                                                                                                      
1467 ((sd-pam)) S 1465 1465 1465 0 -1 1077936448 23 0 0 0 0 0 0 0 20 0 1 0 3448 63012864 566 18446744073709551615 1 1 0 0 0 0 0 4096 0 0 0 0 17 1 0 0 0 0 0 0 0 0 0 0 0 0 0                  

EDIT: not ProcList but ProcState

panic on FileSystemList.Get

goroutine 83 [running]:
github.com/elastic/gosigar.(*FileSystemList).Get.func1({0xc0019b8ab0, 0xc000ae9000})
	github.com/elastic/gosigar/external/com_github_elastic_gosigar/sigar_linux_common.go:113 +0x1b0
github.com/elastic/gosigar.readFile({0x4e8860e, 0x200000003}, 0xc000ac7440)
	github.com/elastic/gosigar/external/com_github_elastic_gosigar/sigar_linux_common.go:386 +0x208
github.com/elastic/gosigar.(*FileSystemList).Get(0xc000ac7508)
	github.com/elastic/gosigar/external/com_github_elastic_gosigar/sigar_linux_common.go:106 +0x8f
github.com/cockroachdb/cockroach/pkg/storage.getFileSystemProperties({0x6355138, 0xc000828e40}, {0xc00095f2f0, 0x21})
	github.com/cockroachdb/cockroach/pkg/storage/store_properties.go:60 +0x1d4
github.com/cockroachdb/cockroach/pkg/storage.computeStoreProperties({0x6355138, 0xc000828e40}, {0xc00095f2f0, 0x3d}, 0x47, 0x59)

If an entry in the mount table file doesn't have the options defined, then FileSystemList.Get can panic as shown.

cpu time off by a factor of 40x on M1 Macs

I believe ProcTime.Get is broken on M1 (and probably M2) Macs.
It does

	self.User = uint64(info.ptinfo.pti_total_user) / uint64(time.Millisecond)

but, on Darwin, pti_total_user needs to be scaled up by a factor of 125/3 because it is not expressed in nanos, but in "mach ticks" (I believe these ticks used to be nanos on Intel Macs). See https://developer.apple.com/documentation/driverkit/3433733-mach_timebase_info.

For reference, this is how htop does it.

build failed with darwin_386

this is the failed log:

##[error]/Users/runner/go/pkg/mod/github.com/elastic/[email protected]/concrete_sigar.go:20:11: cpuUsage.Get undefined (type Cpu has no field or method Get)
##[error]/Users/runner/go/pkg/mod/github.com/elastic/[email protected]/concrete_sigar.go:30:13: cpuUsage.Get undefined (type Cpu has no field or method Get)
##[error]/Users/runner/go/pkg/mod/github.com/elastic/[email protected]/concrete_sigar.go:49:10: l.Get undefined (type LoadAverage has no field or method Get)
##[error]/Users/runner/go/pkg/mod/github.com/elastic/[email protected]/concrete_sigar.go:55:10: m.Get undefined (type Mem has no field or method Get)
##[error]/Users/runner/go/pkg/mod/github.com/elastic/[email protected]/concrete_sigar.go:61:10: s.Get undefined (type Swap has no field or method Get)
##[error]/Users/runner/go/pkg/mod/github.com/elastic/[email protected]/concrete_sigar.go:67:10: p.Get undefined (type HugeTLBPages has no field or method Get)
##[error]/Users/runner/go/pkg/mod/github.com/elastic/[email protected]/concrete_sigar.go:79:11: fd.Get undefined (type FDUsage has no field or method Get)
##[error]/Users/runner/go/pkg/mod/github.com/elastic/[email protected]/sigar_darwin_386.go:11:12: undefined: sysctlbyname

you can see on this link:
https://github.com/glvd/accipfs/runs/573143054?check_suite_focus=true

i build my project with windows,linux,darwin
but only the darwin_386 was failed.

Add process environment variables

I would like to be able to retrieve the environment variables that were used to start a process.

• Linux
  • Read from /proc/<pid>/environ
• Windows
  • There is no direct way to get this data for other processes. But there are indirect ways:
  • http://blog.gapotchenko.com/eazfuscator.net/reading-environment-variables
  • https://stackoverflow.com/questions/1202653/check-for-environment-variable-in-another-process
  • https://www.codeproject.com/kb/threads/readprocenv.aspx?display=print
• OS X
  • The code already exists in the gosigar, but it's not used.

Does not build on FreeBSD

When building elastic/beats, that uses version v0.6.0 of gosigar, I get this: # github.com/elastic/beats/vendor/github.com/elastic/gosigar ../../src/github.com/elastic/beats/vendor/github.com/elastic/gosigar/sigar_freebsd.go:111: (*ProcTime).Get redeclared in this block previous declaration at ../../src/github.com/elastic/beats/vendor/github.com/elastic/gosigar/sigar_linux_common.go:277:6

Just commenting out the (*ProcTime).Get function in gosigar_linux_common.go fixes the problem for me. Perhaps the fix is a easy as moving that function from gosigar_linux_common.go to gosigar_linux.go?

Adding the patch in master does regarding gosigar_stub.go does not help.

Add support for receiving kernel audit messages

This library already has other netlink code, so adding support for receiving audit messages from the kernel over netlink shouldn't take a large effort. But parsing and enriching the data will take more effort.

• Add an audit_set_pid function to register our process with the kernel to receive events. #66
• Add a function for receiving events. #66
• Add the ability to parse the key/value data from the string. #68
• Enrich data with table lookups (e.g. arch to name, syscall to name, hex decoding, sockaddr decoding, etc.). #68
• Add functions for enabling audit, setting the rate limit, and setting the backlog limit. #69
• Add the ability to detect dropped events.
• Add a mechanism to set rules (either natively or by executing auditctl).
• Add UID enrichment.

CpuList fails on 32-bit Windows

On 64-bit sizeof=48, and on 32-bit sizeof=44. However when invoking NtQuerySystemInformation on 32-bit Windows XP, it is failing because it expects the size to be 48. I guess there is a difference in alignments between the compilers (i.e. #pragma pack(4) vs. #pragma pack(8)).

// https://msdn.microsoft.com/en-us/library/windows/desktop/ms724509(v=vs.85).aspx
type _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION struct {
    IdleTime   int64
    KernelTime int64
    UserTime   int64
    Reserved1  [2]int64
    Reserved2  uint32
}

Socket test failing in Beats

While building Beats on a Big Endian system, one of the socket related test fails which uses Go sigar code sys/linux/inetdiag.go. Will it be possible to add Big Endian support in Go sigar ?

fatal error: checkptr: unsafe pointer conversion

Under Go 1.14.4 with the race detector running gosigar fails at

gosigar/sigar_util.go

Line 10 in 5603641

bytes := (*[10000]byte)(unsafe.Pointer(ptr))

=== RUN   TestFetch
fatal error: checkptr: unsafe pointer conversion

goroutine 50 [running]:
runtime.throw(0x48dfb0e, 0x23)
	/Users/akroh/.gvm/versions/go1.14.4.darwin.amd64/src/runtime/panic.go:1116 +0x72 fp=0xc00016b7c8 sp=0xc00016b798 pc=0x4036fd2
runtime.checkptrAlignment(0xc000652458, 0x4819a40, 0x1)
	/Users/akroh/.gvm/versions/go1.14.4.darwin.amd64/src/runtime/checkptr.go:20 +0xc9 fp=0xc00016b7f8 sp=0xc00016b7c8 pc=0x4008e39
github.com/elastic/gosigar.bytePtrToString(0xc000652458, 0x4dbe04f, 0x1)
	/Users/akroh/go/pkg/mod/github.com/elastic/[email protected]/sigar_util.go:10 +0x52 fp=0xc00016b850 sp=0xc00016b7f8 pc=0x4728c12
github.com/elastic/gosigar.(*FileSystemList).Get(0xc00016b9a8, 0x0, 0x0)
	/Users/akroh/go/pkg/mod/github.com/elastic/[email protected]/sigar_darwin.go:183 +0x1e5 fp=0xc00016b950 sp=0xc00016b850 pc=0x4728ea5
github.com/elastic/beats/v7/metricbeat/module/system/filesystem.GetFileSystemList(0x4757d17, 0xc00050a780, 0xc0000bcac0, 0x1, 0x1)
	/Users/akroh/go/src/github.com/elastic/beats/metricbeat/module/system/filesystem/helper.go:55 +0x4e fp=0xc00016b9d0 sp=0xc00016b950 pc=0x475923e
github.com/elastic/beats/v7/metricbeat/module/system/filesystem.(*MetricSet).Fetch(0xc000640a20, 0x49d00e0, 0xc0006171d0, 0x400cfea, 0x486b620)

Merging Changes back to Cloudfoundry/gosigar

Hey All,

Wanted to stop by and compliment the amount of work that has been done on gosigar - its great. Would love to discuss how we can get these two libraries merged back together. For now, I am going to add some of the same windows support that you all have included here back to cloudfoundry/gosigar.

StartTime on Windows is wrong

The ProcTime.StartTime value is given in milliseconds since unix epoch. But on Windows epoch time is since 1601-01-01T00:00:00Z instead of 1970-01-01T00:00:00Z so we must subtract out the difference to convert Windows epoch to unix epoch.

Expose ProcessorQueueLength from Windows for use in metricbeats

Windows doesn't have a load but a very similar function could be derived from System\Processor Queue Length.
Per http://www.teamquest.com/pdfs/whitepaper/ldavg1.pdf and http://www.teamquest.com/pdfs/whitepaper/ldavg2.pdf Linux uses this exact metric and calculates load at the OS level.
This query should return information that contains the ProcessorQueueLength, and then it can be averaged over time or left to the user to do that if they want in elasticsearch/kibana

	var dst []Win32_PerfRawData_PerfOS_System
	q := wmi.CreateQuery(&dst, "")
	err := wmi.Query(q, &dst)
	if err != nil {
		return Win32_PerfRawData_PerfOS_System{}, errors.Wrap(err, "wmi query for Win32_PerfRawData_PerfOS_System failed")
	}
	if len(dst) != 1 {
		return Win32_PerfRawData_PerfOS_System{}, errors.New("wmi query for Win32_PerfRawData_PerfOS_System failed")
	}
	return dst[0], nil```
I could be wrong about this function but something like this should expose the queue length.

Linux number of processors

There is a test failure on Travis due to the number of processors being different that what is expected on Linux. This issue needs to be investigated.

[CI] Move project to the right CI directory

It's under the Beats CI directory, but we have a Library one, where all other libs live

Overflows in total actual memory/swap

Some issues have been reported regarding weird huge values for used memory or swap. The reported values are near max uint64, and are calculated as Used = Total - Free. It seems that somehow at some moments the reported Free actual memory or swap is greater than Total memory or swap.

Cases reported so far:

• elastic/beats#6271
• https://discuss.elastic.co/t/metricbeat-5-3-0-reporting-strange-memory-value/124825

undefined type syscall.Timeval32 Usec and Sec methods

I am not able to compile on darwin/386, any ideas ?

../../../../../vendor/github.com/elastic/gosigar/sigar_darwin.go:50:45: tv.Sec undefined (type syscall.Timeval32 has no field or method Sec)
../../../../../vendor/github.com/elastic/gosigar/sigar_darwin.go:50:60: tv.Usec undefined (type syscall.Timeval32 has no field or method Usec)

revision = "f75810decf6f4d88b130bfc4d2ba7ccdcea0c01d"
version = "v0.10.4"

GVM was not installed in the build

It looks like the new CI pipeline is having some issues:

[2021-02-05T19:28:09.522Z] C:\Users\jenkins\workspace\Beats_gosigar_PR-152>WHERE /q gvm.exe 
[2021-02-05T19:28:09.522Z] C:\Users\jenkins\workspace\Beats_gosigar_PR-152>gvm.exe version 
[2021-02-05T19:28:09.522Z] gvm: error: Malformed version: version
[2021-02-05T19:28:09.522Z] C:\Users\jenkins\workspace\Beats_gosigar_PR-152>REM Install the given go version 
[2021-02-05T19:28:09.522Z] 
[2021-02-05T19:28:09.522Z] C:\Users\jenkins\workspace\Beats_gosigar_PR-152>gvm.exe --debug install  
[2021-02-05T19:28:09.522Z] gvm: error: no version specified
[2021-02-05T19:28:09.522Z] 
[2021-02-05T19:28:09.522Z] C:\Users\jenkins\workspace\Beats_gosigar_PR-152>REM Configure the given go version 
[2021-02-05T19:28:09.522Z] 
[2021-02-05T19:28:09.522Z] C:\Users\jenkins\workspace\Beats_gosigar_PR-152>FOR /F "tokens=*" %i IN ('"gvm.exe" use --format batch') DO %i
[2021-02-05T19:28:09.522Z] gvm: error: no version specified
[2021-02-05T19:28:09.522Z] 
[2021-02-05T19:28:09.522Z] C:\Users\jenkins\workspace\Beats_gosigar_PR-152>go env 
[2021-02-05T19:28:09.522Z] 'go' is not recognized as an internal or external command,
[2021-02-05T19:28:09.522Z] operable program or batch file.
[2021-02-05T19:28:09.522Z] 
[2021-02-05T19:28:09.522Z] C:\Users\jenkins\workspace\Beats_gosigar_PR-152>IF ERRORLEVEL 1 (
[2021-02-05T19:28:09.522Z] REM go is not configured correctly.  
[2021-02-05T19:28:09.522Z]  exit /b 1 
[2021-02-05T19:28:09.522Z] ) 

I tried fixing this myself, but realized that wherever the code for this build stage is coming from isn't the .ci directory, so I'm not sure what's doing this. @andrewkroh @kuisathaverat

Get the cpu usage per core in Windows

The following function needs to be implemented.

func (self *CpuList) Get() error {
    return notImplemented()
}

Getting cpu usage per core under Unix systems is implemented in the PR: https://github.com/elastic/topbeat/pull/130

Report number of handles / file descriptors held by processes

It would be nice to be able to report the number of handles (Windows) or file descriptors (*nix) in the process metrics. I can implement the Linux side of things easily and with some trying might be able to manage the OpenBSD and Darwin implementation. I would much appreciate someone with more experience with C doing those though. I haven't looked into the Windows side of things yet.

Readme: link to developer guide not working.

Link to the developer guide in Contributing section gives 404.
Instead of
https://www.elastic.co/guide/en/beats/libbeat/master/new-beat.html
IMO following is the right link
https://www.elastic.co/guide/en/beats/libbeat/current/new-beat.html

Incorrect import path in examples/ss

Hello,

There is an incorrect import path for logrus in examples/ss/ss.go - it is written as github.com/Sirupsen/logrus but should be github.com/sirupsen/logrus with a lowercase 's'.

This results in any module-aware go command that tries to load the package producing an error:

$ go list github.com/elastic/gosigar/...
go: github.com/Sirupsen/[email protected]: parsing go.mod: unexpected module path "github.com/sirupsen/logrus"
go: error loading module requirements

Thanks!

Get network interface statistics

Hi,

I'd like to collect network interface statistics with topbeat (someone has already opened an enhancement request: elastic/beats#640).

In order to implement the network statistics in topbeat it might be helpful to get the absolute values (bytes/packets sent/received, errors, etc.) via gosigar.

Is the code already in the making? If not I'd be happy to contribute and create a PR for the network interface stats.