discover

Documentation

Index

• Constants
• func CriteriaMatcherProvider(cm CriteriaMatcher) (node.MiddleFunc[[]Event[processPorts], []Event[ProcessMatch]], error)
• func ExecTyperProvider(ecfg ExecTyper) (node.MiddleFunc[[]Event[ProcessMatch], []Event[Instrumentable]], error)
• func FindingCriteria(cfg *pipe.Config) services.DefinitionCriteria
• func TraceAttacherProvider(ta TraceAttacher) (node.TerminalFunc[[]Event[Instrumentable]], error)
• func WatcherProvider(w Watcher) (node.StartFunc[[]Event[processPorts]], error)
• type CriteriaMatcher
• type Event
• type ExecTyper
• type Instrumentable
• type PID
• type ProcessFinder
  • func NewProcessFinder(ctx context.Context, cfg *pipe.Config, metrics imetrics.Reporter) *ProcessFinder
  • func (pf *ProcessFinder) Start(cfg *pipe.Config) (<-chan *ebpf.ProcessTracer, error)
• type ProcessMatch
• type TraceAttacher
• type WatchEventType
• type Watcher

Constants

const (
	EventCreated = WatchEventType(iota)
	EventDeleted
)

Functions

func CriteriaMatcherProvider

func CriteriaMatcherProvider(cm CriteriaMatcher) (node.MiddleFunc[[]Event[processPorts], []Event[ProcessMatch]], error)

func ExecTyperProvider

func ExecTyperProvider(ecfg ExecTyper) (node.MiddleFunc[[]Event[ProcessMatch], []Event[Instrumentable]], error)

func FindingCriteria

func FindingCriteria(cfg *pipe.Config) services.DefinitionCriteria

func TraceAttacherProvider

func TraceAttacherProvider(ta TraceAttacher) (node.TerminalFunc[[]Event[Instrumentable]], error)

func WatcherProvider

func WatcherProvider(w Watcher) (node.StartFunc[[]Event[processPorts]], error)

Types

type CriteriaMatcher

type CriteriaMatcher struct {
	Cfg *pipe.Config
}

CriteriaMatcher filters the processes that match the discovery criteria.

type Event

type Event[T any] struct {
	Type WatchEventType
	Obj  T
}

type ExecTyper

type ExecTyper struct {
	Cfg     *pipe.Config
	Metrics imetrics.Reporter
}

ExecTyper classifies the discovered executables according to the executable type (Go, generic...), and filters these executables that are not instrumentable.

type Instrumentable

type Instrumentable struct {
	Type svc.InstrumentableType

	// in some runtimes, like python gunicorn, we need to allow
	// tracing both the parent pid and all of its children pid
	ChildPids []uint32

	FileInfo *exec.FileInfo
	Offsets  *goexec.Offsets
}

type PID

type PID int32

type ProcessFinder

type ProcessFinder struct {
	Watcher         `sendTo:"CriteriaMatcher"`
	CriteriaMatcher `sendTo:"ExecTyper"`
	ExecTyper       `sendTo:"TraceAttacher"`
	TraceAttacher
}

ProcessFinder pipeline architecture. It uses the Pipes library to instantiate and connect all the nodes.

func NewProcessFinder

func NewProcessFinder(ctx context.Context, cfg *pipe.Config, metrics imetrics.Reporter) *ProcessFinder

func (*ProcessFinder) Start

func (pf *ProcessFinder) Start(cfg *pipe.Config) (<-chan *ebpf.ProcessTracer, error)

Start the ProcessFinder pipeline in background. It returns a channel where each new discovered ebpf.ProcessTracer will be notified.

type ProcessMatch

type ProcessMatch struct {
	Criteria *services.Attributes
	Process  *services.ProcessInfo
}

ProcessMatch matches a found process with the first selection criteria it fulfilled.

type TraceAttacher

type TraceAttacher struct {
	Cfg               *pipe.Config
	Ctx               context.Context
	DiscoveredTracers chan *ebpf.ProcessTracer
	Metrics           imetrics.Reporter
	// contains filtered or unexported fields
}

TraceAttacher creates the available trace.Tracer implementations (Go HTTP tracer, GRPC tracer, Generic tracer...) for each received Instrumentable process and forwards an ebpf.ProcessTracer instance ready to run and start instrumenting the executable

type WatchEventType

type WatchEventType int

type Watcher

type Watcher struct {
	Ctx context.Context
	Cfg *pipe.Config
}

Watcher polls every PollInterval for new processes and forwards either new or deleted process PIDs as well as PIDs from processes that setup a new connection