Enhance deduplication to consider PID and PPNAME

- Update deduplication unique key to include: name + UID + PID + PPNAME
- Same process with different PID or parent is now tracked separately
- Captures process lifecycle and parent relationship changes
- Increases entries from ~2K to ~4K in typical datasets (more accurate tracking)

Author: itayfoLY

src/sysdiagnose/analysers/ps_everywhere.py

@@ -272,7 +272,7 @@ def __extract_ps_base_file(self) -> Generator[dict, None, None]:
                     module=self.module_name,
                     data={'source': entity_type, 'uid': uid, 'pid': pid, 'ppid': ppid, 'ppname': ppname}
                 )
-                if self.add_if_full_command_is_not_in_set(ps_event.message, ps_event.datetime, uid):
+                if self.add_if_full_command_is_not_in_set(ps_event.message, ps_event.datetime, uid, pid, ppname):
                     yield ps_event.to_dict()
         except Exception as e:
             logger.exception(f"ERROR while extracting {entity_type} file. {e}")
@@ -297,7 +297,7 @@ def __extract_ps_thread_file(self) -> Generator[dict, None, None]:
                     module=self.module_name,
                     data={'source': entity_type, 'uid': uid, 'pid': pid, 'ppid': ppid, 'ppname': ppname}
                 )
-                if self.add_if_full_command_is_not_in_set(ps_event.message, ps_event.datetime, uid):
+                if self.add_if_full_command_is_not_in_set(ps_event.message, ps_event.datetime, uid, pid, ppname):
                     yield ps_event.to_dict()
         except Exception as e:
             logger.exception(f"ERROR while extracting {entity_type} file. {e}")
@@ -322,7 +322,7 @@ def __extract_ps_spindump_nosymbols_file(self) -> Generator[dict, None, None]:
                 # Spindump has a direct 'parent' field with the parent process name
                 ppname = p.get('parent')
 
-                if self.add_if_full_command_is_not_in_set(self._strip_flags(process_name), event_datetime, uid):
+                if self.add_if_full_command_is_not_in_set(self._strip_flags(process_name), event_datetime, uid, pid, ppname):
                     yield Event(
                         datetime=event_datetime,
                         message=self._strip_flags(process_name),
@@ -334,7 +334,7 @@ def __extract_ps_spindump_nosymbols_file(self) -> Generator[dict, None, None]:
                 for t in p['threads']:
                     try:
                         thread_name = f"{self._strip_flags(process_name)}::{t['thread_name']}"
-                        if self.add_if_full_command_is_not_in_set(thread_name, event_datetime, uid):
+                        if self.add_if_full_command_is_not_in_set(thread_name, event_datetime, uid, pid, ppname):
                             yield Event(
                                 datetime=event_datetime,
                                 message=self._strip_flags(thread_name),
@@ -391,7 +391,7 @@ def __extract_ps_logarchive(self) -> Generator[dict, None, None]:
                     # Handle the case where extracted_process is a list of paths
                     if isinstance(extracted_process, list):
                         for proc_path in extracted_process:
-                            if self.add_if_full_command_is_not_in_set(self._strip_flags(proc_path), p_datetime, None):
+                            if self.add_if_full_command_is_not_in_set(self._strip_flags(proc_path), p_datetime, None, None, None):
                                 yield Event(
                                     p_datetime,
                                     message=self._strip_flags(proc_path),
@@ -401,7 +401,7 @@ def __extract_ps_logarchive(self) -> Generator[dict, None, None]:
                                 ).to_dict()
                     else:
                         # Handle the case where it's a single string
-                        if self.add_if_full_command_is_not_in_set(self._strip_flags(extracted_process), p_datetime, None):
+                        if self.add_if_full_command_is_not_in_set(self._strip_flags(extracted_process), p_datetime, None, None, None):
                             yield Event(
                                 datetime=p_datetime,
                                 message=self._strip_flags(extracted_process),
@@ -411,7 +411,7 @@ def __extract_ps_logarchive(self) -> Generator[dict, None, None]:
                             ).to_dict()
 
                 # Process the original process name
-                if self.add_if_full_command_is_not_in_set(self._strip_flags(p['data']['process']), p_datetime, euid):
+                if self.add_if_full_command_is_not_in_set(self._strip_flags(p['data']['process']), p_datetime, euid, pid, None):
                     yield Event(
                         datetime=p_datetime,
                         message=self._strip_flags(p['data']['process']),
@@ -431,7 +431,7 @@ def __extract_ps_uuid2path(self) -> Generator[dict, None, None]:
         entity_type = 'uuid2path'
         try:
             for p in UUID2PathParser(self.config, self.case_id).get_result().values():
-                if self.add_if_full_command_is_not_in_set(self._strip_flags(p), self.sysdiagnose_creation_datetime, None):
+                if self.add_if_full_command_is_not_in_set(self._strip_flags(p), self.sysdiagnose_creation_datetime, None, None, None):
                     yield Event(
                         datetime=self.sysdiagnose_creation_datetime,
                         message=self._strip_flags(p),
@@ -456,7 +456,7 @@ def __extract_ps_taskinfo(self) -> Generator[dict, None, None]:
 
                 p_datetime = datetime.fromisoformat(p['datetime'])
                 pid = p['data'].get('pid')
-                if self.add_if_full_path_is_not_in_set(self._strip_flags(p['data']['name']), p_datetime, None):
+                if self.add_if_full_path_is_not_in_set(self._strip_flags(p['data']['name']), p_datetime, None, pid, None):
                     yield Event(
                         datetime=p_datetime,
                         message=self._strip_flags(p['data']['name']),
@@ -468,7 +468,7 @@ def __extract_ps_taskinfo(self) -> Generator[dict, None, None]:
                 for t in p['data']['threads']:
                     try:
                         thread_name = f"{self._strip_flags(p['data']['name'])}::{t['thread name']}"
-                        if self.add_if_full_path_is_not_in_set(thread_name, p_datetime, None):
+                        if self.add_if_full_path_is_not_in_set(thread_name, p_datetime, None, pid, None):
                             yield Event(
                                 p_datetime,
                                 message=thread_name,
@@ -492,7 +492,7 @@ def __extract_ps_remotectl_dumpstate(self) -> Generator[dict, None, None]:
             remotectl_dumpstate_json = RemotectlDumpstateParser(self.config, self.case_id).get_result()
             if remotectl_dumpstate_json:
                 for p in remotectl_dumpstate_json['Local device']['Services']:
-                    if self.add_if_full_path_is_not_in_set(self._strip_flags(p), self.sysdiagnose_creation_datetime, None):
+                    if self.add_if_full_path_is_not_in_set(self._strip_flags(p), self.sysdiagnose_creation_datetime, None, None, None):
                         yield Event(
                             datetime=self.sysdiagnose_creation_datetime,
                             message=self._strip_flags(p),
@@ -513,7 +513,7 @@ def __extract_ps_logdata_statistics(self) -> Generator[dict, None, None]:
         try:
             for p in LogDataStatisticsParser(self.config, self.case_id).get_result():
                 p_datetime = datetime.fromisoformat(p['datetime'])
-                if self.add_if_full_command_is_not_in_set(self._strip_flags(p['data']['process']), p_datetime, None):
+                if self.add_if_full_command_is_not_in_set(self._strip_flags(p['data']['process']), p_datetime, None, None, None):
                     yield Event(
                         datetime=p_datetime,
                         message=self._strip_flags(p['data']['process']),
@@ -535,7 +535,7 @@ def __extract_ps_logdata_statistics_txt(self) -> Generator[dict, None, None]:
         try:
             for p in LogDataStatisticsTxtParser(self.config, self.case_id).get_result():
                 p_datetime = datetime.fromisoformat(p['datetime'])
-                if self.add_if_full_path_is_not_in_set(self._strip_flags(p['data']['process']), p_datetime, None):
+                if self.add_if_full_path_is_not_in_set(self._strip_flags(p['data']['process']), p_datetime, None, None, None):
                     yield Event(
                         datetime=p_datetime,
                         message=self._strip_flags(p['data']['process']),
@@ -547,19 +547,21 @@ def __extract_ps_logdata_statistics_txt(self) -> Generator[dict, None, None]:
         except Exception as e:
             logger.exception(f"ERROR while extracting {entity_type}. {e}")
 
-    def add_if_full_path_is_not_in_set(self, name: str, timestamp: Optional[datetime] = None, uid: Optional[int] = None) -> bool:
+    def add_if_full_path_is_not_in_set(self, name: str, timestamp: Optional[datetime] = None, uid: Optional[int] = None, pid: Optional[int] = None, ppname: Optional[str] = None) -> bool:
         """
         Ensures that a process path is unique before adding it to the shared set,
         with time-based deduplication: only keep duplicates if they occur more than 1 hour apart.
-        UID is considered part of the uniqueness - same process with different UID is treated as separate.
+        UID, PID, and PPNAME are considered part of the uniqueness - same process with different values is treated as separate.
 
         :param name: Process path name
         :param timestamp: Timestamp of the process occurrence (optional, for time-based deduplication)
         :param uid: User ID of the process (optional, considered in uniqueness check)
+        :param pid: Process ID (optional, considered in uniqueness check)
+        :param ppname: Parent process name (optional, considered in uniqueness check)
         :return: True if the process was not in the set or last seen > 1 hour ago, False otherwise.
         """
-        # Create a unique key that includes both name and UID
-        unique_key = f"{name}|uid:{uid}"
+        # Create a unique key that includes name, UID, PID, and PPNAME
+        unique_key = f"{name}|uid:{uid}|pid:{pid}|ppname:{ppname}"
 
         # If no timestamp provided, use old behavior (always check for duplicates)
         if timestamp is None:
@@ -585,19 +587,21 @@ def add_if_full_path_is_not_in_set(self, name: str, timestamp: Optional[datetime
         self.process_last_seen[unique_key] = timestamp
         return True
 
-    def add_if_full_command_is_not_in_set(self, name: str, timestamp: Optional[datetime] = None, uid: Optional[int] = None) -> bool:
+    def add_if_full_command_is_not_in_set(self, name: str, timestamp: Optional[datetime] = None, uid: Optional[int] = None, pid: Optional[int] = None, ppname: Optional[str] = None) -> bool:
         """
         Ensures that a process command is unique before adding it to the shared set,
         with time-based deduplication: only keep duplicates if they occur more than 1 hour apart.
-        UID is considered part of the uniqueness - same process with different UID is treated as separate.
+        UID, PID, and PPNAME are considered part of the uniqueness - same process with different values is treated as separate.
 
         :param name: Process command name
         :param timestamp: Timestamp of the process occurrence (optional, for time-based deduplication)
         :param uid: User ID of the process (optional, considered in uniqueness check)
+        :param pid: Process ID (optional, considered in uniqueness check)
+        :param ppname: Parent process name (optional, considered in uniqueness check)
         :return: True if the process was not in the set or last seen > 1 hour ago, False otherwise.
         """
-        # Create a unique key that includes both name and UID
-        unique_key = f"{name}|uid:{uid}"
+        # Create a unique key that includes name, UID, PID, and PPNAME
+        unique_key = f"{name}|uid:{uid}|pid:{pid}|ppname:{ppname}"
 
         # If no timestamp provided, use old behavior (always check for duplicates)
         if timestamp is None: