I'm try to monitor all processes by ES client. But I found the process name is different from the Activity Monitor displayed. As shown in the picture below, there are ShareSheetUI(Pages) and ShareSheetUI(Finder) processes in Activity Monitor, but I can only get the same name ShareSheetUI, I thought of many ways to display the name in parentheses, but nothing worked, so there is a way to display the process name like Activity Monitor?
I haven't tested this, but I think what you need to do use the value of "responsible_audit_token", which you'd then map "back" to the original pid/info. However, there are a few things to be aware of there:
responsible_audit_token is only valid as long as the parent is still active, so you'd need to gather this data at process creation time, NOT at a later point when you "needed it".
In "live" code, I think this is data you'd want to be retrieving from your own internal tracking, NOT by going through the system. My own instinct would be to maintain my own data set for "currently running process" (based on audit tokens) then use the responsible_audit_token to find the responsible process in my own data set. Similarly, data like "app name" would be fetched once (probably at process launch time, probably asynchronously) and then pulled from my in memory store as needed.
How are you mapping any of these processes to user meaningful name? Are you going through the file system path (working "back") from the executable? Or are you mapping back through the PID?
__
Kevin Elliott
DTS Engineer, CoreOS/Hardware