Fix deduplication to use PPID instead of PPNAME

- Changed unique key from name+uid+pid+ppname to name+uid+pid+ppid
- PPID is more reliable (numeric) than PPNAME (can be None)
- Properly tracks processes with same PID but different parent contexts
- PPNAME is still included in output data for human readability

Author: itayfoLY

src/sysdiagnose/analysers/ps_everywhere.py

@@ -272,7 +272,7 @@ def __extract_ps_base_file(self) -> Generator[dict, None, None]:
                     module=self.module_name,
                     data={'source': entity_type, 'uid': uid, 'pid': pid, 'ppid': ppid, 'ppname': ppname}
                 )
-                if self.add_if_full_command_is_not_in_set(ps_event.message, ps_event.datetime, uid, pid, ppname):
+                if self.add_if_full_command_is_not_in_set(ps_event.message, ps_event.datetime, uid, pid, ppid):
                     yield ps_event.to_dict()
         except Exception as e:
             logger.exception(f"ERROR while extracting {entity_type} file. {e}")
@@ -297,7 +297,7 @@ def __extract_ps_thread_file(self) -> Generator[dict, None, None]:
                     module=self.module_name,
                     data={'source': entity_type, 'uid': uid, 'pid': pid, 'ppid': ppid, 'ppname': ppname}
                 )
-                if self.add_if_full_command_is_not_in_set(ps_event.message, ps_event.datetime, uid, pid, ppname):
+                if self.add_if_full_command_is_not_in_set(ps_event.message, ps_event.datetime, uid, pid, ppid):
                     yield ps_event.to_dict()
         except Exception as e:
             logger.exception(f"ERROR while extracting {entity_type} file. {e}")
@@ -322,7 +322,7 @@ def __extract_ps_spindump_nosymbols_file(self) -> Generator[dict, None, None]:
                 # Spindump has a direct 'parent' field with the parent process name
                 ppname = p.get('parent')
 
-                if self.add_if_full_command_is_not_in_set(self._strip_flags(process_name), event_datetime, uid, pid, ppname):
+                if self.add_if_full_command_is_not_in_set(self._strip_flags(process_name), event_datetime, uid, pid, ppid):
                     yield Event(
                         datetime=event_datetime,
                         message=self._strip_flags(process_name),
@@ -334,7 +334,7 @@ def __extract_ps_spindump_nosymbols_file(self) -> Generator[dict, None, None]:
                 for t in p['threads']:
                     try:
                         thread_name = f"{self._strip_flags(process_name)}::{t['thread_name']}"
-                        if self.add_if_full_command_is_not_in_set(thread_name, event_datetime, uid, pid, ppname):
+                        if self.add_if_full_command_is_not_in_set(thread_name, event_datetime, uid, pid, ppid):
                             yield Event(
                                 datetime=event_datetime,
                                 message=self._strip_flags(thread_name),
@@ -547,21 +547,21 @@ def __extract_ps_logdata_statistics_txt(self) -> Generator[dict, None, None]:
         except Exception as e:
             logger.exception(f"ERROR while extracting {entity_type}. {e}")
 
-    def add_if_full_path_is_not_in_set(self, name: str, timestamp: Optional[datetime] = None, uid: Optional[int] = None, pid: Optional[int] = None, ppname: Optional[str] = None) -> bool:
+    def add_if_full_path_is_not_in_set(self, name: str, timestamp: Optional[datetime] = None, uid: Optional[int] = None, pid: Optional[int] = None, ppid: Optional[int] = None) -> bool:
         """
         Ensures that a process path is unique before adding it to the shared set,
         with time-based deduplication: only keep duplicates if they occur more than 1 hour apart.
-        UID, PID, and PPNAME are considered part of the uniqueness - same process with different values is treated as separate.
+        UID, PID, and PPID are considered part of the uniqueness - same process with different values is treated as separate.
 
         :param name: Process path name
         :param timestamp: Timestamp of the process occurrence (optional, for time-based deduplication)
         :param uid: User ID of the process (optional, considered in uniqueness check)
         :param pid: Process ID (optional, considered in uniqueness check)
-        :param ppname: Parent process name (optional, considered in uniqueness check)
+        :param ppid: Parent Process ID (optional, considered in uniqueness check)
         :return: True if the process was not in the set or last seen > 1 hour ago, False otherwise.
         """
-        # Create a unique key that includes name, UID, PID, and PPNAME
-        unique_key = f"{name}|uid:{uid}|pid:{pid}|ppname:{ppname}"
+        # Create a unique key that includes name, UID, PID, and PPID
+        unique_key = f"{name}|uid:{uid}|pid:{pid}|ppid:{ppid}"
 
         # If no timestamp provided, use old behavior (always check for duplicates)
         if timestamp is None:
@@ -587,21 +587,21 @@ def add_if_full_path_is_not_in_set(self, name: str, timestamp: Optional[datetime
         self.process_last_seen[unique_key] = timestamp
         return True
 
-    def add_if_full_command_is_not_in_set(self, name: str, timestamp: Optional[datetime] = None, uid: Optional[int] = None, pid: Optional[int] = None, ppname: Optional[str] = None) -> bool:
+    def add_if_full_command_is_not_in_set(self, name: str, timestamp: Optional[datetime] = None, uid: Optional[int] = None, pid: Optional[int] = None, ppid: Optional[int] = None) -> bool:
         """
         Ensures that a process command is unique before adding it to the shared set,
         with time-based deduplication: only keep duplicates if they occur more than 1 hour apart.
-        UID, PID, and PPNAME are considered part of the uniqueness - same process with different values is treated as separate.
+        UID, PID, and PPID are considered part of the uniqueness - same process with different values is treated as separate.
 
         :param name: Process command name
         :param timestamp: Timestamp of the process occurrence (optional, for time-based deduplication)
         :param uid: User ID of the process (optional, considered in uniqueness check)
         :param pid: Process ID (optional, considered in uniqueness check)
-        :param ppname: Parent process name (optional, considered in uniqueness check)
+        :param ppid: Parent Process ID (optional, considered in uniqueness check)
         :return: True if the process was not in the set or last seen > 1 hour ago, False otherwise.
         """
-        # Create a unique key that includes name, UID, PID, and PPNAME
-        unique_key = f"{name}|uid:{uid}|pid:{pid}|ppname:{ppname}"
+        # Create a unique key that includes name, UID, PID, and PPID
+        unique_key = f"{name}|uid:{uid}|pid:{pid}|ppid:{ppid}"
 
         # If no timestamp provided, use old behavior (always check for duplicates)
         if timestamp is None: