-
-
Notifications
You must be signed in to change notification settings - Fork 2.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Use total_size within watchdog on Windows #7157
Conversation
Shouldn't we just use the
I believe the issue talks about Windows, but given that Private Bytes also accounts for paged out memory, we should also change the behavior on the other platforms for consistency. On Linux you might need to sum other counters like VmSwap or similar (I only had a brief look at this). |
Also, this is slightly tangential, but now that I see, we don't have a "1:1" mapping between Linux and Windows on I'm not totally sure on Windows how you would take that though. |
Right, perhaps we need a new column "private_size". Then we can switch back to using Working Set for Windows. I am unsure how to get the virtual size to accurately set "total_size". The private size on Linux would be a summation of Private Dirty values within smaps. (My best guess at the most accurate representation.) |
I'm in favor of adding such a column, but what I was trying to say is that the expectation and definition of Also given that we already have such value in the And I mean, specifically changing here: osquery/osquery/core/watcher.cpp Line 413 in e85c91f
and here: osquery/osquery/core/watcher.cpp Line 504 in e85c91f
to get |
Yeap, I agree |
Introducing a new |
See #6537,
we should at least be usingPrivateBytes
for our definition ofresident_size
.Update: based on discussion here, we are choosing to address the issue by using
total_size
within the watchdog logic.