From 43d345eff4dbc6160f83897f8229fc89ce8a8459 Mon Sep 17 00:00:00 2001
From: Paulo Janotti <pjanotti@splunk.com>
Date: Mon, 16 Dec 2024 11:31:28 -0800
Subject: [PATCH] [extension/sumologic] Skip zombie processes on Windows
 (#36772)

#### Description
On Windows it consistently fails to get the name of certain processes,
likely zombie process, reporting: "A device attached to the system is
not functioning."

My long term recommendation will be for the owners to directly use the
Win32 API to get process information instead of the library: while it
uses the correct permissions to get the process name it is not using the
flag that allows to get the device name path which should avoid this
issue even for zombie processes, I'm not sure if that is desirable or
not.


#### Link to tracking issue
Fixes #36481

#### Testing
Repro the failure locally and checked that the test passed locally with
the change.
I couldn't lint it locally on Windows (tool crash, will use CI to check
that)

#### Documentation

Added changelog
---
 ...ip_likely_zombie_processes_on_windows.yaml | 27 +++++++++++++++++++
 extension/sumologicextension/extension.go     | 18 ++++++++++---
 2 files changed, 41 insertions(+), 4 deletions(-)
 create mode 100644 .chloggen/sumologicextension_skip_likely_zombie_processes_on_windows.yaml

diff --git a/.chloggen/sumologicextension_skip_likely_zombie_processes_on_windows.yaml b/.chloggen/sumologicextension_skip_likely_zombie_processes_on_windows.yaml
new file mode 100644
index 000000000000..bb11e9b35400
--- /dev/null
+++ b/.chloggen/sumologicextension_skip_likely_zombie_processes_on_windows.yaml
@@ -0,0 +1,27 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: bug_fix
+
+# The name of the component, or a single word describing the area of concern, (e.g. filelogreceiver)
+component: sumologicextension
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Skip likely zombie processes on Windows.
+
+# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
+issues: [36481]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:
+
+# If your change doesn't affect end users or the exported elements of any package,
+# you should instead start your pull request title with [chore] or use the "Skip Changelog" label.
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: []
diff --git a/extension/sumologicextension/extension.go b/extension/sumologicextension/extension.go
index 1fd27cc04499..6c1681bb5643 100644
--- a/extension/sumologicextension/extension.go
+++ b/extension/sumologicextension/extension.go
@@ -15,6 +15,7 @@ import (
 	"net/http"
 	"net/url"
 	"os"
+	"runtime"
 	"strings"
 	"sync"
 	"time"
@@ -728,7 +729,7 @@ var sumoAppProcesses = map[string]string{
 	"sqlservr":              "mssql",     // linux SQL Server process
 }
 
-func filteredProcessList() ([]string, error) {
+func (se *SumologicExtension) filteredProcessList() ([]string, error) {
 	var pl []string
 
 	processes, err := process.Processes()
@@ -739,6 +740,15 @@ func filteredProcessList() ([]string, error) {
 	for _, v := range processes {
 		e, err := v.Name()
 		if err != nil {
+			if runtime.GOOS == "windows" {
+				// On Windows, if we can't get a process name, it is likely a zombie process, assume that and skip them.
+				se.logger.Warn(
+					"Failed to get executable name, it is likely a zombie process, skipping it",
+					zap.Int32("pid", v.Pid),
+					zap.Error(err))
+				continue
+			}
+
 			return nil, fmt.Errorf("Error getting executable name: %w", err)
 		}
 		e = strings.ToLower(e)
@@ -773,12 +783,12 @@ func filteredProcessList() ([]string, error) {
 	return pl, nil
 }
 
-func discoverTags() (map[string]any, error) {
+func (se *SumologicExtension) discoverTags() (map[string]any, error) {
 	t := map[string]any{
 		"sumo.disco.enabled": "true",
 	}
 
-	pl, err := filteredProcessList()
+	pl, err := se.filteredProcessList()
 	if err != nil {
 		return t, err
 	}
@@ -814,7 +824,7 @@ func (se *SumologicExtension) updateMetadataWithHTTPClient(ctx context.Context,
 	td := map[string]any{}
 
 	if se.conf.DiscoverCollectorTags {
-		td, err = discoverTags()
+		td, err = se.discoverTags()
 		if err != nil {
 			return err
 		}