---
title: "Enable process-level information in flow logs"
description: "Add process executable paths and arguments to Calico Cloud flow logs with eBPF instrumentation for process-level visibility into network activity."
product: "Calico Cloud"
version: "v23.0.1"
section: "Observability"
canonical_url: "https://docs.tigera.io/calico-cloud/observability/elastic/flow/processpath"
---

# Enable process-level information in flow logs

## Big picture

Configure Calico Cloud to collect process executable path and arguments and add them to flow logs.

## Value

Get visibility into the network activity at the process level using Calico Cloud flow logs.

## Concepts

### eBPF kprobe programs

eBPF is a Linux kernel technology that allows safe mini-programs to be attached to various hooks inside the kernel. To collect the path and arguments of short-lived processes, this feature uses an eBPF kprobe program.

### Host's PID namespace

For long-lived processes, path and arguments are read from `/proc/pid/cmdline`. This requires access to the host's PID namespace. If the access is not available then the process path and arguments will only be captured (by the eBPF kprobes) for newly-created processes.

## Before you begin

Ensure that your kernel contains support for eBPF kprobes that Calico Cloud uses. The minimum supported kernel for this is feature is: `v4.4.0`.

## Privileges

For full functionality, this feature requires the `calico-node` `DaemonSet` to have access to the host's PID namespace. The Tigera Operator will automatically grant this extra privilege to the daemonset if the feature is enabled in the operator's LogCollector resource, as described below.

# How to

### Enable process path and argument collection

Calico Cloud can be configured to enable process path and argument collection on supported Linux kernels using the command:

```text
 kubectl patch logcollector.operator.tigera.io tigera-secure --type merge -p '{"spec":{"collectProcessPath":"Enabled"}}'
```

Enabling/Disabling collectProcessPath causes a rolling update of the `calico-node DaemonSet`.

The executable path appears in the `process_name` field and `process_args` will have the executable arguments. Executable path and arguments cannot be collected under certain circumstances, in that `process_name` will have the task name and `process_args` will be empty. Information about these fields is described in the [Flow log datatype document](https://docs.tigera.io/calico-cloud/observability/elastic/flow/datatypes.md).