discover

Documentation

Index

• Constants
• func BuildPinPath(cfg *beyla.Config) string
• func ContainerDBUpdaterProvider(enabled bool, db *kube.Database) pipe.MiddleProvider[[]Event[Instrumentable], []Event[Instrumentable]]
• func CriteriaMatcherProvider(cfg *beyla.Config) pipe.MiddleProvider[[]Event[processAttrs], []Event[ProcessMatch]]
• func ExecTyperProvider(cfg *beyla.Config, metrics imetrics.Reporter) pipe.MiddleProvider[[]Event[ProcessMatch], []Event[Instrumentable]]
• func FindingCriteria(cfg *beyla.Config) services.DefinitionCriteria
• func IsMountFS(mntType int64, path string) (bool, bool, error)
• func ProcessWatcherFunc(ctx context.Context, cfg *beyla.Config) pipe.StartFunc[[]Event[processAttrs]]
• func TraceAttacherProvider(ta *TraceAttacher) pipe.FinalProvider[[]Event[Instrumentable]]
• func WatcherKubeEnricherProvider(ctx context.Context, informerProvider kubeMetadataProvider) pipe.MiddleProvider[[]Event[processAttrs], []Event[processAttrs]]
• type Event
• type Instrumentable
• type InstrumentedExecutable
• type PID
• type ProcessFinder
  • func NewProcessFinder(ctx context.Context, cfg *beyla.Config, ctxInfo *global.ContextInfo) *ProcessFinder
  • func (pf *ProcessFinder) Start() (<-chan *ebpf.ProcessTracer, <-chan *Instrumentable, error)
• type ProcessMatch
• type TraceAttacher
• type WatchEventType

Constants

const (
	// FilesystemType superblock magic numbers for filesystems,
	// to be used for IsMountFS.
	FilesystemTypeBPFFS   = unix.BPF_FS_MAGIC
	FilesystemTypeCgroup2 = unix.CGROUP2_SUPER_MAGIC
)

const (
	EventCreated = WatchEventType(iota)
	EventDeleted
)

Functions

func BuildPinPath

func BuildPinPath(cfg *beyla.Config) string

BuildPinPath pinpath must be unique for a given executable group it will be:

• current beyla PID

func ContainerDBUpdaterProvider

func ContainerDBUpdaterProvider(enabled bool, db *kube.Database) pipe.MiddleProvider[[]Event[Instrumentable], []Event[Instrumentable]]

ContainerDBUpdaterProvider is a stage in the Process Finder pipeline that will be enabled only if Kubernetes decoration is enabled. It just updates part of the kubernetes database when a new process is discovered.

func CriteriaMatcherProvider

func CriteriaMatcherProvider(cfg *beyla.Config) pipe.MiddleProvider[[]Event[processAttrs], []Event[ProcessMatch]]

CriteriaMatcherProvider filters the processes that match the discovery criteria.

func ExecTyperProvider

func ExecTyperProvider(cfg *beyla.Config, metrics imetrics.Reporter) pipe.MiddleProvider[[]Event[ProcessMatch], []Event[Instrumentable]]

ExecTyperProvider classifies the discovered executables according to the executable type (Go, generic...), and filters these executables that are not instrumentable.

func FindingCriteria

func FindingCriteria(cfg *beyla.Config) services.DefinitionCriteria

func IsMountFS

func IsMountFS(mntType int64, path string) (bool, bool, error)

IsMountFS returns two boolean values, checking

• whether the path is a mount point;
• if yes, whether its filesystem type is mntType.

Note that this function can not detect bind mounts, and is not working properly when path="/".

func ProcessWatcherFunc

func ProcessWatcherFunc(ctx context.Context, cfg *beyla.Config) pipe.StartFunc[[]Event[processAttrs]]

ProcessWatcherFunc polls every PollInterval for new processes and forwards either new or deleted process PIDs as well as PIDs from processes that setup a new connection

func TraceAttacherProvider

func TraceAttacherProvider(ta *TraceAttacher) pipe.FinalProvider[[]Event[Instrumentable]]

func WatcherKubeEnricherProvider

func WatcherKubeEnricherProvider(
	ctx context.Context,
	informerProvider kubeMetadataProvider,
) pipe.MiddleProvider[[]Event[processAttrs], []Event[processAttrs]]

Types

type Event

type Event[T any] struct {
	Type WatchEventType
	Obj  T
}

type Instrumentable

type Instrumentable struct {
	Type                 svc.InstrumentableType
	InstrumentationError error

	// in some runtimes, like python gunicorn, we need to allow
	// tracing both the parent pid and all of its children pid
	ChildPids []uint32

	FileInfo *exec.FileInfo
	Offsets  *goexec.Offsets
}

type InstrumentedExecutable

type InstrumentedExecutable struct {
	Type                 svc.InstrumentableType
	Offsets              *goexec.Offsets
	InstrumentationError error
}

type PID

type PID int32

type ProcessFinder

type ProcessFinder struct {
	// contains filtered or unexported fields
}

func NewProcessFinder

func NewProcessFinder(ctx context.Context, cfg *beyla.Config, ctxInfo *global.ContextInfo) *ProcessFinder

func (*ProcessFinder) Start

func (pf *ProcessFinder) Start() (<-chan *ebpf.ProcessTracer, <-chan *Instrumentable, error)

Start the ProcessFinder pipeline in background. It returns a channel where each new discovered ebpf.ProcessTracer will be notified.

type ProcessMatch

type ProcessMatch struct {
	Criteria *services.Attributes
	Process  *services.ProcessInfo
}

ProcessMatch matches a found process with the first selection criteria it fulfilled.

type TraceAttacher

type TraceAttacher struct {
	Cfg               *beyla.Config
	Ctx               context.Context
	DiscoveredTracers chan *ebpf.ProcessTracer
	DeleteTracers     chan *Instrumentable
	Metrics           imetrics.Reporter
	// contains filtered or unexported fields
}

TraceAttacher creates the available trace.Tracer implementations (Go HTTP tracer, GRPC tracer, Generic tracer...) for each received Instrumentable process and forwards an ebpf.ProcessTracer instance ready to run and start instrumenting the executable

type WatchEventType

type WatchEventType int