eventcache

Documentation

Index

• Constants
• Variables
• func CacheErrors(er CacheError, eventType tetragon.EventType) prometheus.Counter
• func CacheRetries(entryType CacheEntryType) prometheus.Counter
• func HandleGenericEvent(internal *process.ProcessInternal, ev notify.Event, tid *uint32) error
• func HandleGenericInternal(ev notify.Event, pid uint32, tid *uint32, timestamp uint64) (*process.ProcessInternal, error)
• func RegisterMetrics(group metrics.Group)
• type Cache
  • func Get() *Cache
  • func New(n server.Notifier) *Cache
  • func NewWithTimer(n server.Notifier, dur time.Duration) *Cache
  • func (ec *Cache) Add(internal *process.ProcessInternal, e notify.Event, t uint64, s uint64, ...)
  • func (ec *Cache) Needed(proc *tetragon.Process) bool
• type CacheEntryType
  • func (t CacheEntryType) String() string
• type CacheError
  • func (e CacheError) String() string
• type CacheObj

Constants

const (
	// Event information was completed without cache retries
	NO_EV_CACHE = iota
	// Cache retries was triggered in order to complete event information
	FROM_EV_CACHE
)

Variables

var (
	ErrFailedToGetPodInfo     = errors.New("failed to get pod info from event cache")
	ErrFailedToGetProcessInfo = errors.New("failed to get process info from event cache")
	ErrFailedToGetParentInfo  = errors.New("failed to get parent info from event cache")
)

Functions

func CacheErrors

func CacheErrors(er CacheError, eventType tetragon.EventType) prometheus.Counter

Get a new handle on an eventCacheErrorsTotal metric for an error

func CacheRetries

func CacheRetries(entryType CacheEntryType) prometheus.Counter

Get a new handle on an eventCacheRetriesTotal metric for an entryType

func HandleGenericEvent

func HandleGenericEvent(internal *process.ProcessInternal, ev notify.Event, tid *uint32) error

Generic Event handler without any extra msg specific details or debugging so we only need to wait for the internal link to the process context to resolve PodInfo. This happens when the msg populates the internal state but that event is not fully populated yet.

func HandleGenericInternal

func HandleGenericInternal(ev notify.Event, pid uint32, tid *uint32, timestamp uint64) (*process.ProcessInternal, error)

Generic internal lookup happens when events are received out of order and this event was handled before an exec event so it wasn't able to populate the process info yet.

func RegisterMetrics

func RegisterMetrics(group metrics.Group)

Types

type Cache

type Cache struct {
	// contains filtered or unexported fields
}

func Get

func Get() *Cache

func New

func New(n server.Notifier) *Cache

func NewWithTimer

func NewWithTimer(n server.Notifier, dur time.Duration) *Cache

func (*Cache) Add

func (ec *Cache) Add(internal *process.ProcessInternal,
	e notify.Event,
	t uint64,
	s uint64,
	msg notify.Message)

func (*Cache) Needed

func (ec *Cache) Needed(proc *tetragon.Process) bool

We handle two race conditions here one where the event races with a Tetragon execve event and the other -- much more common -- where we race with K8s watcher case 1 (execve race):

Its possible to receive this Tetragon event before the process event cache
has been populated with a Tetragon execve event. In this case we need to
cache the event until the process cache is populated.

case 2 (k8s watcher race):

Its possible to receive an event before the k8s watcher receives the
podInfo event and populates the local cache. If we expect podInfo,
indicated by having a nonZero dockerID we cache the event until the
podInfo arrives.

type CacheEntryType

type CacheEntryType int

const (
	ProcessInfo CacheEntryType = iota
	ParentInfo
	PodInfo
)

func (CacheEntryType) String

func (t CacheEntryType) String() string

type CacheError

type CacheError int

const (
	NilProcessPid CacheError = iota
)

func (CacheError) String

func (e CacheError) String() string

type CacheObj

type CacheObj struct {
	// contains filtered or unexported fields
}