Diving Into Process Classifier Criteria...

[SlightlyLoony]

You've probably heard that astronomers have changed Pluto's classification from "planet" to a mere "solar system body". Though this happened a couple years ago, there's still considerable debate about how to classify Pluto. But unless you're a scientist working in astronomy, you don't have any say about it.

Discovery lets you completely control how processes get classified. This may not have the romance of classifying a rock twirling around our local star, but at least it's something you can control!

On this subject, a few days ago a customer asked me a very good question: what values are available in the Name field of a process classification criteria, and what exactly do those values contain? You can see what she was talking about in the screenshot at right, which shows a process classifier that I chose from the list I saw when I navigated to Discovery Definition → Process. The field in question is highlighted in orange.

The answer to her question is that it depends — the values are different for each operating system, with minor variations between versions of operating systems. Here's a table with all the details:

Field Value	OS	Description
pid	All	The process ID
name	Windows	The image name of the process (like "crsst.exe")
output	Windows	The entire command line used to start the process
output	Linux, Solaris, AIX	The entire result of the ps command (or the equivalent) for the process
parameters	Windows	The entire command line used to start the process
command	All	The fully qualified path to the process' executable (like "D:\Program Files\Rocks\MyRock.exe")
user	Linux, OS/X	The user that started the process (note that the name may be truncated)
name	Netware	The NLM name

For some operating systems there are actually a few more values, but these are particularly useful for process classification. For example, under OS/X you can also use "vsz", which is the size (in kilobytes) of the process' virtual memory size.

By far the most useful values for process classification are "name" and "command". The latter is especially useful when you need to distinguish between multiple instances of a particualr executable running on the same box. In such a case, you can look for a value in the parameters, which certainly will be different for the different instances...