[BUG] - Multiple PIDs when tracing Clade Code

[AndriyNovykov]

We are seeing multiple PIDs for a single instance of claude.

To Reproduce

1. Connect to remote server running Ubuntu.
2. Clone agentsight repo.
3. Update source to change ip address of server from 127.0.0.1 to 0.0.0.0 (Work around to view UI on local browser).
4. Followed install instructions in readme.
5. Copy agentsight binary to root dir of agentsight repo.
6. Two terminal windows. One is running claude the other is running `sudo ./agentsight record -c 'claude' --server-port 80.
7. Prompt for claude

Please create a python program to solve the following problem: <p>The first two consecutive numbers to have two distinct prime factors are:</p>
$$\begin{align}
14 &amp;= 2 \times 7\\
15 &amp;= 3 \times 5.
\end{align}$$
<p>The first three consecutive numbers to have three distinct prime factors are:</p>
$$\begin{align}
644 &amp;= 2^2 \times 7 \times 23\\
645 &amp;= 3 \times 5 \times 43\\
646 &amp;= 2 \times 17 \times 19.
\end{align}$$
<p>Find the first four consecutive integers to have four distinct prime factors each. What is the first of these numbers?</p>

Screenshots

record.log

Desktop (please complete the following information):

• OS/Version: Ubuntu 24.04.3 LTS (GNU/Linux 6.8.0-85-generic x86_64)
• Claude Code: 2.0.11

Additional context
We are testing agentsight with multiple deployment types (bare-metal, container, VM, microVM, k8s). We are using a VPS on Hostinger.

[yunwei37]

You might need to mannually clean up the record.log if you don't want the previous tracing results?

[AndriyNovykov]

Perhaps I made a mistake here as I can't replicate this issue on Bare-Metal. But I am able to replicate this scenario when I run claude and agentsight within a Docker container. Should I make a separate issue or can we continue here?:

Here are the supporting materials for the container scenario:
record.log

[yunwei37]

Thanks!

[yunwei37]

I also fixed other issues I can see, such as:

1. Wrongly display metrics event as ssl event in the process tree
2. Timestamp display is wrong for th emetrics events

[yunwei37]

But I am able to replicate this scenario when I run claude and agentsight within a Docker container.

The eBPF is not limited by containers. so if you runs the agentsight command inside a container, it can still capture the full system wide events. E.g. if you have another claude code runs outside of the container, it can still capture it.

[AndriyNovykov]

I also fixed other issues I can see, such as:

1. Wrongly display metrics event as ssl event in the process tree
2. Timestamp display is wrong for th emetrics events

To clarify, when you say issue 1 are you referring to the /api/hello logs?

[yunwei37]

The first issue is like this:

[yunwei37]

The second issue is

[yunwei37]

We are seeing multiple PIDs for a single instance of claude.

I also observe similar pattern. Is it because claude code 2.0 will use subagent? So it's not a bug (?

[AndriyNovykov]

It appears that Claude Code does delegate network IO to a sub-process. What should the expected behavior be then?

• Should sub-processes/agents appear under the root process/agent?
• Should they be separate but have an identifier?
• Something else?

What I'm not sure about is why this only occurs inside of a container.

What is the correct way to use agentsight with a containerized agent?

• Should agentsight be installed alongside the agent inside the container?
• Should agentsight be installed on the host machine?

[yunwei37]

I think here are two seperate issues:

Should sub-processes/agents appear under the root process/agent?

From root cause, I think this is a design issue. We need to have a better way to model, organize and display agents/multi-agents, the current process based abstraction may be not enough. For example, we should have a agent view pannel, display and organize agents based on their interaction, e.g. whatever how much process a agent framework have, they should be displayed as a single one ; for subagent, they should be clearly different than tool call subprocess.

For a temporal solution, we can identify where the subprocess is under they same executable file, if yes, then we seen it as a subagent type in the process view, this can make it clear.

What I'm not sure about is why this only occurs inside of a container.

I'm double checking if it's the claude code's behavior or some other bugs.

What is the correct way to use agentsight with a containerized agent?

agentsight should be installed on the host machine. eBPF based solution is installed per-node (per kernel), it can detect anything on the host machine, even if itself is installed in the container. The PID displayed is based on host machine PID, not the namespace PID you see in the container. If you want to have container infomation on the tracer, you need to correlated with the container metadata, e.g. assign the agent process to certain container. I can open a issue if you think this is a required feature.