Struct ProcessInfo 

pub struct ProcessInfo { /* private fields */ }

A snapshot of one process, as of when it was taken.

Every field but pid, name, and start is optional, because no field beyond those is available on every platform, for every target process, to every caller. See the accessors for what limits each one.

Implementations

impl ProcessInfo

pub fn pid(&self) -> u32

Returns the process ID.

pub fn parent_pid(&self) -> Option<u32>

Returns the parent process ID.

The process that created this one, which may have exited since. Unix reparents an orphan to init and so reports a live process; Windows keeps reporting the original creator, whose PID may by then belong to something unrelated.

pub fn name(&self) -> &str

Returns the process name.

The kernel’s short name for the process, not its executable path: Linux and the BSDs truncate it, and it reflects whatever the process last set rather than what it was launched as.

pub fn start_time(&self) -> StartTime

Returns when the process started.

pub fn exe(&self) -> Option<Path<'_>>

Returns the path to the process executable.

pub fn command_line(&self) -> Option<&[String]>

Returns the process command line.

Best-effort: macOS restricts it to processes owned by the same user.

On Windows this is a reconstruction. The kernel stores one string and leaves splitting it to the process, so what is reported here is that string split by the MSVC convention that Rust and every C runtime follow — which is what the target process almost certainly did with it, but not something the system guarantees. windows_command_line has the original.

pub fn windows_command_line(&self) -> Result<Option<&str>>

Returns the process command line as a single unsplit string.

Windows only, where this is the form the kernel actually stores.

Errors

ErrorKind::Unsupported if the record came from a Unix target, where the argument vector is what the kernel holds and there is no original string to fall back to.

pub fn cwd(&self) -> Option<Path<'_>>

Returns the process working directory.

On Windows this is the process’s own bookkeeping rather than something the system tracks: NT has no per-process current directory, so what is reported is the Win32 one the target keeps in its own memory, read from there. A process is free to put anything in that field.

pub fn identity(&self) -> Result<Option<&UnixSecurityInfo>>

Returns the process’s Unix credentials.

The group list holds the supplementary groups alone. The BSDs keep the effective group in the first slot of the credential’s group array and report it that way, so it is dropped here to leave the field meaning the same thing on every target — it is reported by UnixSecurityInfo::effective_gid instead.

On macOS the supplementary group list is the kernel credential list, capped at NGROUPS (16). That is narrower than what SecurityInfo::current reports for this process, which resolves extended memberships through opendirectoryd — an interface that answers only for the caller — so a foreign macOS group list can be a truncated view where the current-process one is not.

Errors

ErrorKind::Unsupported if the record came from a Windows target, which has no such credentials to report.

pub fn token(&self) -> Result<Option<&WindowsTokenInfo>>

Returns the process’s access token information.

None where it could not be read, which every route reports the same way: a process that refuses to be opened, or one whose token the caller has no right to. Nothing about which call produced the record changes what is here.

Errors

ErrorKind::Unsupported if the record came from a Unix target, which has no access tokens.

pub fn exit(&self) -> Option<ProcessExit>

Returns how the process ended, or None if it was still running.

A process can outlive itself in the table: Unix keeps a zombie until its parent reaps it, and Windows keeps an exited process addressable while any handle to it remains open. Such a record still reports what the kernel holds — the PID, the parent, when it started — while everything read out of its address space, the command line and working directory included, is gone. This is what distinguishes that from a live process whose fields were merely denied.

Only Windows reports a code, for the reason ProcessExit gives.

None is also what a record carries when its process could not be examined closely enough to tell, which on Windows means one that could not be opened at all.

pub fn session(&self) -> Uuid

Returns the identity of the target session this was captured from.

Trait Implementations

impl Clone for ProcessInfo

fn clone(&self) -> ProcessInfo

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ProcessInfo

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ProcessInfo

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for ProcessInfo

impl PartialEq for ProcessInfo

fn eq(&self, other: &ProcessInfo) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for ProcessInfo

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ProcessInfo