---
title: "Enable process-level information in flow logs"
description: "Add process executable paths and arguments to Calico Enterprise flow logs with eBPF instrumentation for process-level visibility into network activity."
product: "Calico Enterprise"
version: "3.23 (latest)"
section: "Observability"
canonical_url: "https://docs.tigera.io/calico-enterprise/latest/observability/elastic/flow/processpath"
---

# Enable process-level information in flow logs

## Big picture

Configure Calico Enterprise to collect process executable path and arguments and add them to flow logs.

## Value

Get visibility into the network activity at the process level using Calico Enterprise flow logs.

## Concepts

### eBPF kprobe programs

eBPF is a Linux kernel technology that allows safe mini-programs to be attached to various hooks inside the kernel. To collect the path and arguments of short-lived processes, this feature uses an eBPF kprobe program.

### Host's PID namespace

For long-lived processes, path and arguments are read from `/proc/pid/cmdline`. This requires access to the host's PID namespace. If the access is not available then the process path and arguments will only be captured (by the eBPF kprobes) for newly-created processes.

## Before you begin

Ensure that your kernel contains support for eBPF kprobes that Calico Enterprise uses. The minimum supported kernel for this is feature is: `v4.4.0`.

## Privileges

For full functionality, this feature requires the `calico-node` `DaemonSet` to have access to the host's PID namespace. The Tigera Operator will automatically grant this extra privilege to the daemonset if the feature is enabled in the operator's LogCollector resource, as described below.

# How to

### Enable process path and argument collection

Calico Enterprise can be configured to enable process path and argument collection on supported Linux kernels using the command:

```text
 kubectl patch logcollector.operator.tigera.io tigera-secure --type merge -p '{"spec":{"collectProcessPath":"Enabled"}}'
```

Enabling/Disabling collectProcessPath causes a rolling update of the `calico-node DaemonSet`.

### View process path and arguments in flow logs using Kibana

Navigate to the Kibana Flow logs dashboard to view process path and arguments associated with a flow log entry.

The executable path will appear in the `process_name` field and `process_args` will have the executable arguments. Executable path and arguments cannot be collected under certain circumstances, in that `process_name` will have the task name and `process_args` will be empty. Information about these fields are described in the [Flow log datatype document](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/flow/datatypes.md)