[role="xpack"]

beta[]

This is the `process` dataset of the system module. It generates an event when
a process starts and stops.

It is implemented for Linux, macOS (Darwin), and Windows.

[float]
=== Configuration options

*`process.state.period`*:: The interval at which the dataset sends full state
information. If set this will take precedence over `state.period`. The default
value is `12h`.

*`process.hash.max_file_size`*:: The maximum size of a file in bytes for which
{beatname_uc} will compute hashes. Files larger than this size will not be
hashed. The default value is 100 MiB. For convenience units can be specified as
a suffix to the value. The supported units are `b` (default), `kib`, `kb`,
`mib`, `mb`, `gib`, `gb`, `tib`, `tb`, `pib`, `pb`, `eib`, and `eb`.

*`process.hash.hash_types`*:: A list of hash types to compute when the file
changes. The supported hash types are `blake2b_256`, `blake2b_384`,
`blake2b_512`, `md5`, `sha1`, `sha224`, `sha256`, `sha384`, `sha512`,
`sha512_224`, `sha512_256`, `sha3_224`, `sha3_256`, `sha3_384`, `sha3_512`, and
`xxh64`. The default value is `sha1`.

[float]
==== Example dashboard

The dataset comes with a sample dashboard:

[role="screenshot"]
image::./images/auditbeat-system-process-dashboard.png[Auditbeat System Process Dashboard]
