discover

Documentation

Index

• Constants
• func BuildPinPath(cfg *pipe.Config) string
• func ContainerDBUpdaterProvider(cn *ContainerDBUpdater) (node.MiddleFunc[[]Event[Instrumentable], []Event[Instrumentable]], error)
• func CriteriaMatcherProvider(cm CriteriaMatcher) (node.MiddleFunc[[]Event[processPorts], []Event[ProcessMatch]], error)
• func ExecTyperProvider(ecfg ExecTyper) (node.MiddleFunc[[]Event[ProcessMatch], []Event[Instrumentable]], error)
• func FindingCriteria(cfg *pipe.Config) services.DefinitionCriteria
• func TraceAttacherProvider(ta TraceAttacher) (node.TerminalFunc[[]Event[Instrumentable]], error)
• func WatcherProvider(w Watcher) (node.StartFunc[[]Event[processPorts]], error)
• type ContainerDBUpdater
• type CriteriaMatcher
• type Event
• type ExecTyper
• type Instrumentable
• type PID
• type ProcessFinder
  • func NewProcessFinder(ctx context.Context, cfg *pipe.Config, ctxInfo *global.ContextInfo) *ProcessFinder
  • func (pf *ProcessFinder) Start(cfg *pipe.Config) (<-chan *ebpf.ProcessTracer, error)
• type ProcessMatch
• type TraceAttacher
• type WatchEventType
• type Watcher

Constants

const (
	EventCreated = WatchEventType(iota)
	EventDeleted
)

Functions

func BuildPinPath

func BuildPinPath(cfg *pipe.Config) string

pinpath must be unique for a given executable group it will be:

• current beyla PID

func ContainerDBUpdaterProvider

func ContainerDBUpdaterProvider(cn *ContainerDBUpdater) (node.MiddleFunc[[]Event[Instrumentable], []Event[Instrumentable]], error)

func CriteriaMatcherProvider

func CriteriaMatcherProvider(cm CriteriaMatcher) (node.MiddleFunc[[]Event[processPorts], []Event[ProcessMatch]], error)

func ExecTyperProvider

func ExecTyperProvider(ecfg ExecTyper) (node.MiddleFunc[[]Event[ProcessMatch], []Event[Instrumentable]], error)

func FindingCriteria

func FindingCriteria(cfg *pipe.Config) services.DefinitionCriteria

func TraceAttacherProvider

func TraceAttacherProvider(ta TraceAttacher) (node.TerminalFunc[[]Event[Instrumentable]], error)

func WatcherProvider

func WatcherProvider(w Watcher) (node.StartFunc[[]Event[processPorts]], error)

Types

type ContainerDBUpdater

type ContainerDBUpdater struct {
	DB *kube.Database
}

ContainerDBUpdater is a stage in the Process Finder pipeline that will be enabled only if Kubernetes decoration is enabled. It just updates part of the kubernetes database when a new process is discovered.

type CriteriaMatcher

type CriteriaMatcher struct {
	Cfg *pipe.Config
}

CriteriaMatcher filters the processes that match the discovery criteria.

type Event

type Event[T any] struct {
	Type WatchEventType
	Obj  T
}

type ExecTyper

type ExecTyper struct {
	Cfg     *pipe.Config
	Metrics imetrics.Reporter
}

ExecTyper classifies the discovered executables according to the executable type (Go, generic...), and filters these executables that are not instrumentable.

type Instrumentable

type Instrumentable struct {
	Type svc.InstrumentableType

	// in some runtimes, like python gunicorn, we need to allow
	// tracing both the parent pid and all of its children pid
	ChildPids []uint32

	FileInfo *exec.FileInfo
	Offsets  *goexec.Offsets
}

type PID

type PID int32

type ProcessFinder

type ProcessFinder struct {
	Watcher         `sendTo:"CriteriaMatcher"`
	CriteriaMatcher `sendTo:"ExecTyper"`
	ExecTyper       `sendTo:"ContainerDBUpdater"`
	// ContainerDBUpdater will be only enabled (non-nil value) if Kubernetes decoration is enabled
	*ContainerDBUpdater `forwardTo:"TraceAttacher"`
	TraceAttacher
}

ProcessFinder pipeline architecture. It uses the Pipes library to instantiate and connect all the nodes.

func NewProcessFinder

func NewProcessFinder(ctx context.Context, cfg *pipe.Config, ctxInfo *global.ContextInfo) *ProcessFinder

func (*ProcessFinder) Start

func (pf *ProcessFinder) Start(cfg *pipe.Config) (<-chan *ebpf.ProcessTracer, error)

Start the ProcessFinder pipeline in background. It returns a channel where each new discovered ebpf.ProcessTracer will be notified.

type ProcessMatch

type ProcessMatch struct {
	Criteria *services.Attributes
	Process  *services.ProcessInfo
}

ProcessMatch matches a found process with the first selection criteria it fulfilled.

type TraceAttacher

type TraceAttacher struct {
	Cfg               *pipe.Config
	Ctx               context.Context
	DiscoveredTracers chan *ebpf.ProcessTracer
	Metrics           imetrics.Reporter
	// contains filtered or unexported fields
}

TraceAttacher creates the available trace.Tracer implementations (Go HTTP tracer, GRPC tracer, Generic tracer...) for each received Instrumentable process and forwards an ebpf.ProcessTracer instance ready to run and start instrumenting the executable

type WatchEventType

type WatchEventType int

type Watcher

type Watcher struct {
	Ctx context.Context
	Cfg *pipe.Config
}

Watcher polls every PollInterval for new processes and forwards either new or deleted process PIDs as well as PIDs from processes that setup a new connection