observer

Documentation

Index

• Variables
• func AllListeners(msg notify.Message)
• func DataAdd(id dataapi.DataEventId, msgData []byte) error
• func DataEventMetricInc(event DataEventType)
• func DataEventMetricSizeBad(size uint32)
• func DataEventMetricSizeOk(size uint32)
• func DataGet(desc dataapi.DataEventDesc) ([]byte, error)
• func DataPurge()
• func InitDataCache(size int) error
• func InitMetrics(registry *prometheus.Registry)
• func RegisterEventHandlerAtInit(ev uint8, handler func(r *bytes.Reader) ([]Event, error))
• func RemovePrograms(bpfDir, mapDir string)
• type Channel
  • func NewChannel(conn net.Conn) *Channel
  • func (o Channel) Close() error
  • func (o Channel) Notify(msg interface{}) error
• type DataEventType
• type Event
  • func HandleData(r *bytes.Reader) ([]Event, error)
  • func HandlePerfData(data []byte) (byte, []Event, error)
• type Listener
• type Observer
  • func NewObserver(configFile string) *Observer
  • func (k *Observer) AddListener(listener Listener)
  • func (k *Observer) InitSensorManager(waitChan chan struct{}) error
  • func (k *Observer) LogPinnedBpf(observerDir string)
  • func (k *Observer) PrintStats()
  • func (k *Observer) ReadErrorEvents() uint64
  • func (k *Observer) ReadLostEvents() uint64
  • func (k *Observer) ReadReceivedEvents() uint64
  • func (k *Observer) Remove()
  • func (k *Observer) RemoveListener(listener Listener)
  • func (k *Observer) RemovePrograms()
  • func (k *Observer) RunEvents(stopCtx context.Context, ready func()) error
  • func (k *Observer) Start(ctx context.Context) error
  • func (k *Observer) UpdateRuntimeConf(mapDir string) error

Variables

var (
	// Define a counter metric for data event statistics
	DataEventStats = prometheus.NewCounterVec(prometheus.CounterOpts{
		Namespace:   consts.MetricsNamespace,
		Name:        "data_events_total",
		Help:        "The number of data events by type. For internal use only.",
		ConstLabels: nil,
	}, []string{"event"})

	DataEventSizeHist = prometheus.NewHistogramVec(prometheus.HistogramOpts{
		Namespace:   consts.MetricsNamespace,
		Name:        "data_event_size",
		Help:        "The size of received data events.",
		Buckets:     prometheus.LinearBuckets(1000, 2000, 20),
		ConstLabels: nil,
	}, []string{"op"})
)

var DataEventTypeStrings = map[DataEventType]string{
	DataEventReceived:   "Received",
	DataEventAdded:      "Added",
	DataEventAppended:   "Appended",
	DataEventMatched:    "Matched",
	DataEventNotMatched: "NotMatched",
	DataEventBad:        "Bad",
}

var (

	/* SensorManager handles dynamic sensors loading / unloading. */
	SensorManager *sensors.Manager
)

Functions

func AllListeners

func AllListeners(msg notify.Message)

func DataAdd

func DataAdd(id dataapi.DataEventId, msgData []byte) error

func DataEventMetricInc

func DataEventMetricInc(event DataEventType)

Increment a data event metric for an event type and location

func DataEventMetricSizeBad

func DataEventMetricSizeBad(size uint32)

func DataEventMetricSizeOk

func DataEventMetricSizeOk(size uint32)

func DataGet

func DataGet(desc dataapi.DataEventDesc) ([]byte, error)

func DataPurge

func DataPurge()

func InitDataCache

func InitDataCache(size int) error

func InitMetrics

func InitMetrics(registry *prometheus.Registry)

func RegisterEventHandlerAtInit

func RegisterEventHandlerAtInit(ev uint8, handler func(r *bytes.Reader) ([]Event, error))

func RemovePrograms

func RemovePrograms(bpfDir, mapDir string)

Types

type Channel

type Channel struct {
	// contains filtered or unexported fields
}

Channel is a Listener that gob encodes events and sends them to a network connection.

func NewChannel

func NewChannel(conn net.Conn) *Channel

NewChannel initializes Channel.

func (Channel) Close

func (o Channel) Close() error

Close implements Listener.Notify.

func (Channel) Notify

func (o Channel) Notify(msg interface{}) error

Notify implements Listener.Notify.

type DataEventType

type DataEventType int

const (
	DataEventReceived DataEventType = iota
	DataEventAdded
	DataEventAppended
	DataEventMatched
	DataEventNotMatched
	DataEventBad
)

type Event

type Event notify.Message

func HandleData

func HandleData(r *bytes.Reader) ([]Event, error)

func HandlePerfData

func HandlePerfData(data []byte) (byte, []Event, error)

HandlePerfData returns the events from raw bytes NB: It is made public so that it can be used in testing.

type Listener

type Listener interface {
	// Notify gets called for each events from ObserverKprobe.
	Notify(msg notify.Message) error

	// Close the listener.
	io.Closer
}

Listener defines the interface to receive events from Observer. Listeners will merge and complete out-of-order events before they're passed to human-readable sinks such as the printer or GRPC encoder.

type Observer

type Observer struct {
	PerfConfig *bpf.PerfEventConfig
	// contains filtered or unexported fields
}

Observer represents the link between the BPF perf ring and the listeners. It manages the perf ring and receive events from it. It ensures that the BPF event we are receiving from the kernel is complete. The listeners are notified of their corresponding events.

func NewObserver

func NewObserver(configFile string) *Observer

func (*Observer) AddListener

func (k *Observer) AddListener(listener Listener)

func (*Observer) InitSensorManager

func (k *Observer) InitSensorManager(waitChan chan struct{}) error

InitSensorManager starts the sensor controller

func (*Observer) LogPinnedBpf

func (k *Observer) LogPinnedBpf(observerDir string)

Log Active pinned BPF resources

func (*Observer) PrintStats

func (k *Observer) PrintStats()

func (*Observer) ReadErrorEvents

func (k *Observer) ReadErrorEvents() uint64

func (*Observer) ReadLostEvents

func (k *Observer) ReadLostEvents() uint64

func (*Observer) ReadReceivedEvents

func (k *Observer) ReadReceivedEvents() uint64

func (*Observer) Remove

func (k *Observer) Remove()

func (*Observer) RemoveListener

func (k *Observer) RemoveListener(listener Listener)

func (*Observer) RemovePrograms

func (k *Observer) RemovePrograms()

func (*Observer) RunEvents

func (k *Observer) RunEvents(stopCtx context.Context, ready func()) error

func (*Observer) Start

func (k *Observer) Start(ctx context.Context) error

Start starts the observer

func (*Observer) UpdateRuntimeConf

func (k *Observer) UpdateRuntimeConf(mapDir string) error

UpdateRuntimeConf() Gathers information about Tetragon runtime environment and updates BPF map TetragonConfMap

The observer needs to do this to discover and properly operate on the right cgroup context. Use this function in your tests to allow Pod and Containers association to work.

The environment and cgroup configuration discovery may fail for several reasons, in such cases errors will be logged. On errors we also print a warning that advanced Cgroups tracking will be disabled which might affect process association with kubernetes pods and containers.