o11y IM How to deal with "Could not get process args" events on Windows OS

Available Languages

Updated:September 29, 2026

Document ID:SPLK045524

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Infrastructure Monitoring

Description

Repeatative alerts in Event Viewer logged from SignalFx Smart Agent with the following contents:

*time="<time:stamp>" level=error msg="Could not get process args"
observer=host pid=<PID_ID>*

Investigation

These errors originate from the host observer which lists out all processes and their metadata, so that discovery rules can be used. Under the above conditions verify if the Smart Agent's configuration utilizes any discovery rules. If there's no auto-discovery in place, simply remove or comment the observers section from the agent.yaml configuration file.

Resolution

Configuring observers allows discovering service endpoints that can then be monitored. Host observers look at the current host for listening network endpoints. It will look for all listening sockets on TCP and UDP over IPv4 and IPv6. If an endpoint is discovered, the observers are using its PID as a dimension added to all corresponding metrics.

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release

Was this Document Helpful?

Feedback

Contact Cisco

Open a Support Case
(Requires a Cisco Service Contract)