[Agent] Most Host processes showing as 'sleeping'

[roshan-elastic]

Kibana version:
8.12

Description of the problem including expected versus actual behavior:
Various users have surfaced that processes show as 'sleeping' within the Host 'processes' view which is leading to customers not trusting the 'processes' functionality offered by Elastic.

Example customer issue
Example customer issue

It seems that the majority of processes are reporting as 'sleeping':

Discover - breaking down processes by state (demo cluster)

Host processes (demo cluster)

Could we confirm:

• What 'sleeping' means?
• How is it calculated?
• Is this working correctly? e.g. are most processes expected to show as 'sleeping'?

Steps to reproduce:

1. Spin up a host
2. Deploy Elastic Agent (or metricbeat)
3. Check the process.state fields being emitted in Discover (or the host experience)

Note : We'll try and get some direct customer feedback to help debug this

[roshan-elastic]

Hey @crespocarlos do you know where to triage this to?

[roshan-elastic]

Hey @tomgregoryelastic,

Are you able to provide details of the issue that the customer is facing (or even better...ask them to add information here)?

Anything which can help us figure out whether there is a bug or not (and if so, what it is).

[crespocarlos]

closing this in favor of: elastic/beats#38120. The UI just reads the system.process.state field shipped by beats.