elastic / elastic/integrations

[System] Collect `phys_footprint` for processes (like `top`) on macOS

Open
#20,924 0 comments 0 reactions 0 assignees View on GitHub
needs:triage
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

System [packages/system]

### Dataset Name

system.process

### Integration Version

Latest GA

### Agent Version

9.4.4

### OS Version and Architecture

macOS 15.7.7

### User Goal

`system.process.memory.rss.bytes` is collected from `proc_pidinfo(PROC_PIDTASKALLINFO)` -> `proc_taskinfo.pti_resident_size`. That is resident set size: pages currently in physical RAM. In Activity Monitor this corresponds to **Real Memory**. See: https://github.com/elastic/elastic-agent-system-metrics/blob/v0.14.4/metric/system/process/process_darwin.go#L143-L145

`top`'s **MEM** column is not RSS. On macOS it reports the process **physical footprint** (`phys_footprint`). That is the same value shown in Activity Monitor's **Memory** column. Apple's `footprint(1)` documentation states that `top` MEM, Activity Monitor Memory, and Xcode's memory gauge all use this footprint ledger.

Ideally, the `system` integration could also collect the same memory value reported by `top` or Activity Monitor's Memory column. This would give a better (or different) picture of a processes memory consumption for observability purposes

### Existing Features

Currently, the integration doesn't collect the physical footprint. We do collect `rss.bytes` but it's a different metric.

### What did you see?

Image

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Research direction

Start in elastic-agent-system-metrics' metric/system/process/process_darwin.go, especially the existing RSS collection around lines 143-145, and inspect how process metrics are exposed by the system integration. Determine the macOS process value needed to match top and Activity Monitor, then verify that a separate physical-footprint metric is collected alongside rss.bytes without changing the existing metric.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, macos
Domain
observability-sre
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.