tracing

Documentation

Index

• Constants
• type CapabilitiesEvent
  • func (event *CapabilitiesEvent) GobDecode(buf []byte) error
  • func (event *CapabilitiesEvent) GobEncode() ([]byte, error)
• type ContainerActivityEvent
• type ContainerActivityEventListener
• type DnsEvent
  • func (event *DnsEvent) GobDecode(buf []byte) error
  • func (event *DnsEvent) GobEncode() ([]byte, error)
• type EventSink
• type EventType
• type ExecveEvent
  • func (event *ExecveEvent) GobDecode(buf []byte) error
  • func (event *ExecveEvent) GobEncode() ([]byte, error)
• type GeneralEvent
• type ITracer
• type NetworkEvent
  • func (event *NetworkEvent) GobDecode(buf []byte) error
  • func (event *NetworkEvent) GobEncode() ([]byte, error)
• type OpenEvent
  • func (event *OpenEvent) GobDecode(buf []byte) error
  • func (event *OpenEvent) GobEncode() ([]byte, error)
• type Tracer
  • func NewTracer(nodeName string, k8sConfig *rest.Config, eventSinks []EventSink, ...) *Tracer
  • func (t *Tracer) AddContainerActivityListener(listener ContainerActivityEventListener)
  • func (t *Tracer) AddEventSink(sink EventSink)
  • func (t *Tracer) PeekSyscallInContainer(nsMountId uint64) ([]string, error)
  • func (t *Tracer) RemoveContainerActivityListener(listener ContainerActivityEventListener)
  • func (t *Tracer) RemoveEventSink(sink EventSink)
  • func (t *Tracer) Start() error
  • func (t *Tracer) Stop() error

Constants

const (
	ContainerActivityEventStart = "start"
	ContainerActivityEventStop  = "stop"
)

Types

type CapabilitiesEvent

type CapabilitiesEvent struct {
	GeneralEvent

	Syscall        string
	CapabilityName string
}

func (*CapabilitiesEvent) GobDecode

func (event *CapabilitiesEvent) GobDecode(buf []byte) error

func (*CapabilitiesEvent) GobEncode

func (event *CapabilitiesEvent) GobEncode() ([]byte, error)

Encode/Decode functions for CapabilitiesEvent

type ContainerActivityEvent

type ContainerActivityEvent struct {
	ContainerName string
	PodName       string
	Namespace     string
	Activity      string
	// Low level container information
	ContainerID string
	NsMntId     uint64
}

type ContainerActivityEventListener

type ContainerActivityEventListener interface {
	// OnContainerActivityEvent is called when a container activity event is received
	OnContainerActivityEvent(event *ContainerActivityEvent)
}

type DnsEvent

type DnsEvent struct {
	GeneralEvent

	DnsName   string
	Addresses []string
}

func (*DnsEvent) GobDecode

func (event *DnsEvent) GobDecode(buf []byte) error

func (*DnsEvent) GobEncode

func (event *DnsEvent) GobEncode() ([]byte, error)

Encode/Decode functions for DnsEvent

type EventSink

type EventSink interface {
	// SendExecveEvent sends an execve event to the sink
	SendExecveEvent(event *ExecveEvent)
	// SendOpenEvent sends a OPEN event to the sink
	SendOpenEvent(event *OpenEvent)
	// SendCapabilitiesEvent sends a Capabilities event to the sink
	SendCapabilitiesEvent(event *CapabilitiesEvent)
	// SendDnsEvent sends a Dns event to the sink
	SendDnsEvent(event *DnsEvent)
	// SendNetworkEvent sends a Network event to the sink
	SendNetworkEvent(event *NetworkEvent)
}

type EventType

type EventType int

const (
	ExecveEventType EventType = iota
	OpenEventType
	CapabilitiesEventType
	DnsEventType
	NetworkEventType
	AllEventType
)

type ExecveEvent

type ExecveEvent struct {
	GeneralEvent

	PathName string
	Args     []string
	Env      []string
}

func (*ExecveEvent) GobDecode

func (event *ExecveEvent) GobDecode(buf []byte) error

func (*ExecveEvent) GobEncode

func (event *ExecveEvent) GobEncode() ([]byte, error)

Encode/Decode functions for ExecveEvent

type GeneralEvent

type GeneralEvent struct {
	ContainerName string
	ContainerID   string
	PodName       string
	Namespace     string
	Timestamp     int64
	EventType     EventType
}

type ITracer

type ITracer interface {
	Start() error
	Stop() error
	AddContainerActivityListener(listener ContainerActivityEventListener)
	RemoveContainerActivityListener(listener ContainerActivityEventListener)
	PeekSyscallInContainer(nsMountId uint64) ([]string, error)
	AddEventSink(sink EventSink)
	RemoveEventSink(sink EventSink)
}

type NetworkEvent

type NetworkEvent struct {
	GeneralEvent

	PacketType  string
	Protocol    string
	Port        uint16
	DstEndpoint string
}

func (*NetworkEvent) GobDecode

func (event *NetworkEvent) GobDecode(buf []byte) error

func (*NetworkEvent) GobEncode

func (event *NetworkEvent) GobEncode() ([]byte, error)

Encode/Decode functions for NetowrkEvent

type OpenEvent

type OpenEvent struct {
	GeneralEvent

	TaskName string
	TaskId   int
	PathName string
	Flags    []string
}

func (*OpenEvent) GobDecode

func (event *OpenEvent) GobDecode(buf []byte) error

func (*OpenEvent) GobEncode

func (event *OpenEvent) GobEncode() ([]byte, error)

Encode/Decode functions for OpenEvent

type Tracer

type Tracer struct {
	// contains filtered or unexported fields
}

func NewTracer

func NewTracer(nodeName string, k8sConfig *rest.Config, eventSinks []EventSink, filterByLabel bool) *Tracer

func (*Tracer) AddContainerActivityListener

func (t *Tracer) AddContainerActivityListener(listener ContainerActivityEventListener)

func (*Tracer) AddEventSink

func (t *Tracer) AddEventSink(sink EventSink)

func (*Tracer) PeekSyscallInContainer

func (t *Tracer) PeekSyscallInContainer(nsMountId uint64) ([]string, error)

func (*Tracer) RemoveContainerActivityListener

func (t *Tracer) RemoveContainerActivityListener(listener ContainerActivityEventListener)

func (*Tracer) RemoveEventSink

func (t *Tracer) RemoveEventSink(sink EventSink)

func (*Tracer) Start

func (t *Tracer) Start() error

func (*Tracer) Stop

func (t *Tracer) Stop() error