elastic / elastic/integrations
[System] Collect `phys_footprint` for processes (like `top`) on macOS
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
### Integration Name
System [packages/system]
### Dataset Name
system.process
### Integration Version
Latest GA
### Agent Version
9.4.4
### OS Version and Architecture
macOS 15.7.7
### User Goal
`system.process.memory.rss.bytes` is collected from `proc_pidinfo(PROC_PIDTASKALLINFO)` -> `proc_taskinfo.pti_resident_size`. That is resident set size: pages currently in physical RAM. In Activity Monitor this corresponds to **Real Memory**. See: https://github.com/elastic/elastic-agent-system-metrics/blob/v0.14.4/metric/system/process/process_darwin.go#L143-L145
`top`'s **MEM** column is not RSS. On macOS it reports the process **physical footprint** (`phys_footprint`). That is the same value shown in Activity Monitor's **Memory** column. Apple's `footprint(1)` documentation states that `top` MEM, Activity Monitor Memory, and Xcode's memory gauge all use this footprint ledger.
Ideally, the `system` integration could also collect the same memory value reported by `top` or Activity Monitor's Memory column. This would give a better (or different) picture of a processes memory consumption for observability purposes
### Existing Features
Currently, the integration doesn't collect the physical footprint. We do collect `rss.bytes` but it's a different metric.
### What did you see?
### Anything else?
_No response_
Contributor guide
Research direction
Start in elastic-agent-system-metrics' metric/system/process/process_darwin.go, especially the existing RSS collection around lines 143-145, and inspect how process metrics are exposed by the system integration. Determine the macOS process value needed to match top and Activity Monitor, then verify that a separate physical-footprint metric is collected alongside rss.bytes without changing the existing metric.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, macos
- Domain
- observability-sre
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100