tracing

Documentation

Index

• Constants
• func DetectContainerRuntime(hostMount string) (*containerutilsTypes.RuntimeConfig, error)
• type AtachableTracer
• type CapabilitiesEvent
• type ContainerActivityEvent
• type ContainerActivityEventListener
• type DnsEvent
• type EventSink
• type EventType
• type ExecveEvent
• type GadgetTracerCommon
• type GeneralEvent
• type ITracer
• type NetworkEvent
• type OpenEvent
• type PeekableTracer
• type ProcessDetails
• type SyscallEvent
• type Tracer
  • func NewTracer(nodeName string, k8sConfig *rest.Config, eventSinks []EventSink, ...) *Tracer
  • func (t *Tracer) AddContainerActivityListener(listener ContainerActivityEventListener)
  • func (t *Tracer) AddEventSink(sink EventSink)
  • func (t *Tracer) GenerateContainerEventsOnStart()
  • func (t *Tracer) GetListOfRunningContainers() (*[]ContainerActivityEvent, error)
  • func (t *Tracer) PeekSyscallInContainer(nsMountId uint64) ([]string, error)
  • func (t *Tracer) RemoveContainerActivityListener(listener ContainerActivityEventListener)
  • func (t *Tracer) RemoveEventSink(sink EventSink)
  • func (t *Tracer) Start() error
  • func (t *Tracer) StartTraceContainer(mntns uint64, pid uint32, eventType EventType) error
  • func (t *Tracer) Stop() error
  • func (t *Tracer) StopTraceContainer(mntns uint64, pid uint32, eventType EventType) error
• type TracingState

Constants

const (
	ContainerActivityEventStart    = "start"
	ContainerActivityEventAttached = "attached"
	ContainerActivityEventStop     = "stop"
)

Functions

func DetectContainerRuntime

func DetectContainerRuntime(hostMount string) (*containerutilsTypes.RuntimeConfig, error)

Types

type AtachableTracer

type AtachableTracer interface {
	Attach(pid uint32) error
	Detach(pid uint32) error
	Close()
}

type CapabilitiesEvent

type CapabilitiesEvent struct {
	GeneralEvent

	Syscall        string
	CapabilityName string
}

type ContainerActivityEvent

type ContainerActivityEvent struct {
	ContainerName string
	PodName       string
	Namespace     string
	Activity      string
	// Low level container information
	ContainerID string
	NsMntId     uint64
	Pid         uint32
}

type ContainerActivityEventListener

type ContainerActivityEventListener interface {
	// OnContainerActivityEvent is called when a container activity event is received
	OnContainerActivityEvent(event *ContainerActivityEvent)
}

type DnsEvent

type DnsEvent struct {
	GeneralEvent

	DnsName   string
	Addresses []string
}

type EventSink

type EventSink interface {
	// SendExecveEvent sends an execve event to the sink
	SendExecveEvent(event *ExecveEvent)
	// SendOpenEvent sends a OPEN event to the sink
	SendOpenEvent(event *OpenEvent)
	// SendCapabilitiesEvent sends a Capabilities event to the sink
	SendCapabilitiesEvent(event *CapabilitiesEvent)
	// SendDnsEvent sends a Dns event to the sink
	SendDnsEvent(event *DnsEvent)
	// SendNetworkEvent sends a Network event to the sink
	SendNetworkEvent(event *NetworkEvent)
}

type EventType

type EventType int

const (
	ExecveEventType EventType = iota
	OpenEventType
	CapabilitiesEventType
	DnsEventType
	NetworkEventType
	SyscallEventType
	AllEventType
)

type ExecveEvent

type ExecveEvent struct {
	GeneralEvent

	PathName string
	Args     []string
	Env      []string
}

type GadgetTracerCommon

type GadgetTracerCommon interface {
	Stop()
}

type GeneralEvent

type GeneralEvent struct {
	ProcessDetails
	ContainerName string
	ContainerID   string
	PodName       string
	Namespace     string
	MountNsID     uint64
	Timestamp     int64
	EventType     EventType
}

type ITracer

type ITracer interface {
	Start() error
	Stop() error
	AddContainerActivityListener(listener ContainerActivityEventListener)
	RemoveContainerActivityListener(listener ContainerActivityEventListener)
	PeekSyscallInContainer(nsMountId uint64) ([]string, error)
	AddEventSink(sink EventSink)
	RemoveEventSink(sink EventSink)
	StartTraceContainer(mntns uint64, pid uint32, eventType EventType) error
	StopTraceContainer(mntns uint64, pid uint32, eventType EventType) error
}

type NetworkEvent

type NetworkEvent struct {
	GeneralEvent

	PacketType  string
	Protocol    string
	Port        uint16
	DstEndpoint string
}

type OpenEvent

type OpenEvent struct {
	GeneralEvent

	TaskName string
	TaskId   uint32
	PathName string
	Flags    []string
}

type PeekableTracer

type PeekableTracer interface {
	Peek(nsMountId uint64) ([]string, error)
	Close()
}

type ProcessDetails

type ProcessDetails struct {
	Pid  uint32
	Ppid uint32
	Comm string
	Cwd  string
	Uid  uint32
	Gid  uint32
}

type SyscallEvent

type SyscallEvent struct {
	GeneralEvent

	Syscalls []string
}

type Tracer

type Tracer struct {
	// contains filtered or unexported fields
}

func NewTracer

func NewTracer(nodeName string, k8sConfig *rest.Config, eventSinks []EventSink, filterByLabel bool) *Tracer

func (*Tracer) AddContainerActivityListener

func (t *Tracer) AddContainerActivityListener(listener ContainerActivityEventListener)

func (*Tracer) AddEventSink

func (t *Tracer) AddEventSink(sink EventSink)

func (*Tracer) GenerateContainerEventsOnStart

func (t *Tracer) GenerateContainerEventsOnStart()

func (*Tracer) GetListOfRunningContainers

func (t *Tracer) GetListOfRunningContainers() (*[]ContainerActivityEvent, error)

func (*Tracer) PeekSyscallInContainer

func (t *Tracer) PeekSyscallInContainer(nsMountId uint64) ([]string, error)

func (*Tracer) RemoveContainerActivityListener

func (t *Tracer) RemoveContainerActivityListener(listener ContainerActivityEventListener)

func (*Tracer) RemoveEventSink

func (t *Tracer) RemoveEventSink(sink EventSink)

func (*Tracer) Start

func (t *Tracer) Start() error

func (*Tracer) StartTraceContainer

func (t *Tracer) StartTraceContainer(mntns uint64, pid uint32, eventType EventType) error

func (*Tracer) Stop

func (t *Tracer) Stop() error

func (*Tracer) StopTraceContainer

func (t *Tracer) StopTraceContainer(mntns uint64, pid uint32, eventType EventType) error

type TracingState

type TracingState struct {
	// contains filtered or unexported fields
}