discover

Documentation

Index

• Constants
• func ContainerDBUpdaterProvider(ctx context.Context, meta kubeMetadataProvider) ...
• func CriteriaMatcherProvider(cfg *beyla.Config) pipe.MiddleProvider[[]Event[processAttrs], []Event[ProcessMatch]]
• func ExecTyperProvider(cfg *beyla.Config, metrics imetrics.Reporter, ...) pipe.MiddleProvider[[]Event[ProcessMatch], []Event[ebpf.Instrumentable]]
• func FindingCriteria(cfg *beyla.Config) services.DefinitionCriteria
• func IsMountFS(mntType int64, path string) (bool, bool, error)
• func ProcessWatcherFunc(ctx context.Context, cfg *beyla.Config) pipe.StartFunc[[]Event[processAttrs]]
• func TraceAttacherProvider(ta *TraceAttacher) pipe.FinalProvider[[]Event[ebpf.Instrumentable]]
• func WatcherKubeEnricherProvider(ctx context.Context, kubeMetaProvider kubeMetadataProvider) pipe.MiddleProvider[[]Event[processAttrs], []Event[processAttrs]]
• type Event
• type InstrumentedExecutable
• type PID
• type ProcessFinder
  • func NewProcessFinder(ctx context.Context, cfg *beyla.Config, ctxInfo *global.ContextInfo, ...) *ProcessFinder
  • func (pf *ProcessFinder) Start() (<-chan *ebpf.Instrumentable, <-chan *ebpf.Instrumentable, error)
• type ProcessMatch
• type TraceAttacher
• type WatchEventType

Constants

const (
	EventCreated = WatchEventType(iota)
	EventDeleted
)

const (
	// FilesystemType superblock magic numbers for filesystems,
	// to be used for IsMountFS.
	FilesystemTypeCgroup2 = unix.CGROUP2_SUPER_MAGIC
)

Functions

func ContainerDBUpdaterProvider

func ContainerDBUpdaterProvider(ctx context.Context, meta kubeMetadataProvider) pipe.MiddleProvider[[]Event[ebpf.Instrumentable], []Event[ebpf.Instrumentable]]

ContainerDBUpdaterProvider is a stage in the Process Finder pipeline that will be enabled only if Kubernetes decoration is enabled. It just updates part of the kubernetes database when a new process is discovered.

func CriteriaMatcherProvider

func CriteriaMatcherProvider(cfg *beyla.Config) pipe.MiddleProvider[[]Event[processAttrs], []Event[ProcessMatch]]

CriteriaMatcherProvider filters the processes that match the discovery criteria.

func ExecTyperProvider

func ExecTyperProvider(cfg *beyla.Config, metrics imetrics.Reporter, k8sInformer *kube.MetadataProvider) pipe.MiddleProvider[[]Event[ProcessMatch], []Event[ebpf.Instrumentable]]

ExecTyperProvider classifies the discovered executables according to the executable type (Go, generic...), and filters these executables that are not instrumentable.

func FindingCriteria

func FindingCriteria(cfg *beyla.Config) services.DefinitionCriteria

func IsMountFS

func IsMountFS(mntType int64, path string) (bool, bool, error)

IsMountFS returns two boolean values, checking

• whether the path is a mount point;
• if yes, whether its filesystem type is mntType.

Note that this function can not detect bind mounts, and is not working properly when path="/".

func ProcessWatcherFunc

func ProcessWatcherFunc(ctx context.Context, cfg *beyla.Config) pipe.StartFunc[[]Event[processAttrs]]

ProcessWatcherFunc polls every PollInterval for new processes and forwards either new or deleted process PIDs as well as PIDs from processes that setup a new connection

func TraceAttacherProvider

func TraceAttacherProvider(ta *TraceAttacher) pipe.FinalProvider[[]Event[ebpf.Instrumentable]]

func WatcherKubeEnricherProvider

func WatcherKubeEnricherProvider(
	ctx context.Context,
	kubeMetaProvider kubeMetadataProvider,
) pipe.MiddleProvider[[]Event[processAttrs], []Event[processAttrs]]

Types

type Event

type Event[T any] struct {
	Type WatchEventType
	Obj  T
}

type InstrumentedExecutable

type InstrumentedExecutable struct {
	Type                 svc.InstrumentableType
	Offsets              *goexec.Offsets
	InstrumentationError error
}

type PID

type PID int32

type ProcessFinder

type ProcessFinder struct {
	// contains filtered or unexported fields
}

func NewProcessFinder

func NewProcessFinder(ctx context.Context, cfg *beyla.Config, ctxInfo *global.ContextInfo, tracesInput chan<- []request.Span) *ProcessFinder

func (*ProcessFinder) Start

func (pf *ProcessFinder) Start() (<-chan *ebpf.Instrumentable, <-chan *ebpf.Instrumentable, error)

Start the ProcessFinder pipeline in background. It returns a channel where each new discovered ebpf.ProcessTracer will be notified.

type ProcessMatch

type ProcessMatch struct {
	Criteria *services.Attributes
	Process  *services.ProcessInfo
}

ProcessMatch matches a found process with the first selection criteria it fulfilled.

type TraceAttacher

type TraceAttacher struct {
	Cfg               *beyla.Config
	Ctx               context.Context
	DiscoveredTracers chan *ebpf.Instrumentable
	DeleteTracers     chan *ebpf.Instrumentable
	Metrics           imetrics.Reporter

	// Usually, only ebpf.Tracer implementations will send spans data to the read decorator.
	// But on each new process, we will send a "process alive" span type to the read decorator, whose
	// unique purpose is to notify other parts of the system that this process is active, even
	// if no spans are detected. This would allow, for example, to start instrumenting this process
	// from the Process metrics pipeline even before it starts to do/receive requests.
	SpanSignalsShortcut chan<- []request.Span
	// contains filtered or unexported fields
}

TraceAttacher creates the available trace.Tracer implementations (Go HTTP tracer, GRPC tracer, Generic tracer...) for each received Instrumentable process and forwards an ebpf.ProcessTracer instance ready to run and start instrumenting the executable

type WatchEventType

type WatchEventType int