(skywalking-rover) branch main updated: Fix repeated process detected/dead churn from tracepoint reporting thread TID instead of process TGID (#211)

[wusheng]

This is an automated email from the ASF dual-hosted git repository.

wu-sheng pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/skywalking-rover.git


The following commit(s) were added to refs/heads/main by this push:
     new 718d212  Fix repeated process detected/dead churn from tracepoint 
reporting thread TID instead of process TGID (#211)
718d212 is described below

commit 718d21292ea5ce66c301ce447f9042433ebf6c7e
Author: mrproliu <741550...@qq.com>
AuthorDate: Mon Jun 29 13:59:36 2026 +0800

    Fix repeated process detected/dead churn from tracepoint reporting thread 
TID instead of process TGID (#211)
---
 CHANGES.md                      | 1 +
 bpf/accesslog/process/process.c | 6 +++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/CHANGES.md b/CHANGES.md
index 164ca9c..6b72e40 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -30,6 +30,7 @@ Release Notes.
 
 #### Bug Fixes
 * Fix the base image cannot run in the arm64.
+* Fix process fork tracepoint reporting thread TID instead of process TGID, 
causing repeated process detected/dead churn.
 
 #### Documentation
 * Add a dead link checker in the CI.
diff --git a/bpf/accesslog/process/process.c b/bpf/accesslog/process/process.c
index ae58740..3658c5c 100644
--- a/bpf/accesslog/process/process.c
+++ b/bpf/accesslog/process/process.c
@@ -37,7 +37,11 @@ struct trace_event_raw_sched_process_fork {
 
 SEC("tracepoint/sched/sched_process_fork")
 int tracepoint_sched_process_fork(struct trace_event_raw_sched_process_fork* 
ctx) {
-    __u32 tgid = ctx->parent_pid;
+    // ctx->parent_pid is the forking task's TID (thread id), not the process 
id.
+    // For multi-threaded apps (e.g. JVM) a worker thread forking would report 
its
+    // thread TID, which the periodic /proc scan never lists, causing the 
process to
+    // flip between detected and dead. Use the real TGID instead.
+    __u32 tgid = bpf_get_current_pid_tgid() >> 32;
     // adding to the monitor
     __u32 v = 1;
     bpf_map_update_elem(&process_monitor_control, &tgid, &v, 0);