PROCESS_STATE_EXITED Event Type

Indicates a process has moved from the RUNNING state to theEXITED state.

Name: PROCESS_STATE_EXITED

Subtype Of: PROCESS_STATE

Body Description

This body is a token set. It has the default set of key/value pairsplus two additional keys: pid and expected. pidrepresents the UNIX process id of the process that exited.expected represents whether the process exited with an expectedexit code or not. It will be 0 if the exit code was unexpected,or 1 if the exit code was expected. For example:

  1. processname:cat groupname:cat from_state:RUNNING expected:0 pid:2766