From 6253bf812d9e1c41fe193c3b0ac0e5dda69d18f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan-Otto=20Kr=C3=B6pke?= <mail@jkroepke.de>
Date: Sun, 3 Aug 2025 20:09:03 +0200
Subject: [PATCH] process: Add flag to control the export of the process
 cmdline (#2153)

---
 docs/collector.process.md             |  5 ++++
 internal/collector/process/process.go | 33 +++++++++++++++++++--------
 2 files changed, 28 insertions(+), 10 deletions(-)

diff --git a/docs/collector.process.md b/docs/collector.process.md
index a7d1a203..9c60a1f6 100644
--- a/docs/collector.process.md
+++ b/docs/collector.process.md
@@ -42,6 +42,11 @@ Disabled by default, and can be enabled with `--collector.process.iis`. NOTE: Ju
 Version of the process collector to use. 1 for Process V1, 2 for Process V2.
 Defaults to 0 which will use the latest version available.
 
+### `--collector.process.cmdline`
+
+Enables the `cmdline` label for the process metrics.
+This label contains the command line used to start the process.
+Enabled by default, and can be turned off with `--no-collector.process.cmdline`.
 
 ### Example
 To match all firefox processes: `--collector.process.include="firefox.*"`.
diff --git a/internal/collector/process/process.go b/internal/collector/process/process.go
index e8fc4f47..c0968462 100644
--- a/internal/collector/process/process.go
+++ b/internal/collector/process/process.go
@@ -44,6 +44,7 @@ type Config struct {
 	ProcessInclude      *regexp.Regexp `yaml:"include"`
 	ProcessExclude      *regexp.Regexp `yaml:"exclude"`
 	EnableWorkerProcess bool           `yaml:"iis"`
+	EnableCMDLine       bool           `yaml:"cmdline"`
 	CounterVersion      uint8          `yaml:"counter-version"`
 }
 
@@ -52,6 +53,7 @@ var ConfigDefaults = Config{
 	ProcessInclude:      types.RegExpAny,
 	ProcessExclude:      types.RegExpEmpty,
 	EnableWorkerProcess: false,
+	EnableCMDLine:       true,
 	CounterVersion:      0,
 }
 
@@ -131,6 +133,11 @@ func NewWithFlags(app *kingpin.Application) *Collector {
 		"Enable IIS collectWorker process name queries. May cause the collector to leak memory.",
 	).Default(strconv.FormatBool(c.config.EnableWorkerProcess)).BoolVar(&c.config.EnableWorkerProcess)
 
+	app.Flag(
+		"collector.process.cmdline",
+		"If enabled, the full cmdline is exposed to the windows_process_info metrics.",
+	).Default(strconv.FormatBool(c.config.EnableCMDLine)).BoolVar(&c.config.EnableCMDLine)
+
 	app.Flag(
 		"collector.process.counter-version",
 		"Version of the process collector to use. 1 for Process V1, 2 for Process V2. Defaults to 0 which will use the latest version available.",
@@ -415,19 +422,25 @@ func (c *Collector) getExtendedProcessInformation(hProcess windows.Handle) (stri
 		return "", 0, fmt.Errorf("failed to read process memory: %w", err)
 	}
 
-	cmdLineUTF16 := make([]uint16, processParameters.CommandLine.Length)
+	var cmdLine string
 
-	err = windows.ReadProcessMemory(hProcess,
-		uintptr(unsafe.Pointer(processParameters.CommandLine.Buffer)),
-		(*byte)(unsafe.Pointer(&cmdLineUTF16[0])),
-		uintptr(processParameters.CommandLine.Length),
-		nil,
-	)
-	if err != nil {
-		return "", processParameters.ProcessGroupId, fmt.Errorf("failed to read process memory: %w", err)
+	if c.config.EnableCMDLine {
+		cmdLineUTF16 := make([]uint16, processParameters.CommandLine.Length)
+
+		err = windows.ReadProcessMemory(hProcess,
+			uintptr(unsafe.Pointer(processParameters.CommandLine.Buffer)),
+			(*byte)(unsafe.Pointer(&cmdLineUTF16[0])),
+			uintptr(processParameters.CommandLine.Length),
+			nil,
+		)
+		if err != nil {
+			return "", processParameters.ProcessGroupId, fmt.Errorf("failed to read process memory: %w", err)
+		}
+
+		cmdLine = strings.TrimSpace(windows.UTF16ToString(cmdLineUTF16))
 	}
 
-	return strings.TrimSpace(windows.UTF16ToString(cmdLineUTF16)), processParameters.ProcessGroupId, nil
+	return cmdLine, processParameters.ProcessGroupId, nil
 }
 
 func (c *Collector) getProcessOwner(logger *slog.Logger, hProcess windows.Handle) (string, error) {