processmanager

Documentation

Overview

Package processmanager manages the loading and unloading of information related to processes.

Index

• type FileIDMapper
• type MapFileIDMapper
  • func NewMapFileIDMapper() *MapFileIDMapper
  • func (fm *MapFileIDMapper) Get(key host.FileID) (libpf.FileID, bool)
  • func (fm *MapFileIDMapper) Set(key host.FileID, value libpf.FileID)
• type Mapping
  • func (m *Mapping) GetOnDiskFileIdentifier() util.OnDiskFileIdentifier
• type ProcessManager
  • func New(ctx context.Context, includeTracers types.IncludedTracers, ...) (*ProcessManager, error)
  • func (pm *ProcessManager) AddSynthIntervalData(fileID host.FileID, data sdtypes.IntervalData) error
  • func (pm *ProcessManager) CleanupPIDs()
  • func (pm *ProcessManager) Close()
  • func (pm *ProcessManager) ConvertTrace(trace *host.Trace) (newTrace *libpf.Trace)
  • func (pm *ProcessManager) MaybeNotifyAPMAgent(rawTrace *host.Trace, umTraceHash libpf.TraceHash, count uint16) string
  • func (pm *ProcessManager) ProcessPIDExit(pid libpf.PID) bool
  • func (pm *ProcessManager) SymbolizationComplete(traceCaptureKTime times.KTime)
  • func (pm *ProcessManager) SynchronizeProcess(pr process.Process)

Types

type FileIDMapper

type FileIDMapper interface {
	// Get retrieves the 128-bit file ID for the provided 64-bit file ID. Otherwise,
	// the second return value is false.
	Get(pre host.FileID) (libpf.FileID, bool)
	// Set adds a mapping from the 64-bit file ID to the 128-bit file ID.
	Set(pre host.FileID, post libpf.FileID)
}

FileIDMapper is responsible for mapping between 64-bit file IDs to 128-bit file IDs. The file ID mappings are inserted typically at the same time the files are hashed. The 128-bit file IDs are retrieved prior to reporting requests to the collection agent.

type MapFileIDMapper

type MapFileIDMapper struct {
	// contains filtered or unexported fields
}

MapFileIDMapper implements the FileIDMApper using a map (for testing)

func NewMapFileIDMapper

func NewMapFileIDMapper() *MapFileIDMapper

func (*MapFileIDMapper) Get

func (fm *MapFileIDMapper) Get(key host.FileID) (libpf.FileID, bool)

func (*MapFileIDMapper) Set

func (fm *MapFileIDMapper) Set(key host.FileID, value libpf.FileID)

type Mapping

type Mapping struct {
	// FileID represents the host-wide unique identifier of the mapped file.
	FileID host.FileID

	// Vaddr represents the starting virtual address of the mapping.
	Vaddr libpf.Address

	// Bias is the offset between the ELF on-disk virtual address space and the
	// virtual address where it is actually mapped in the process. Thus it is the
	// virtual address bias or "ASLR offset". It serves as a translation offset
	// from the process VA space into the VA space of the ELF file. It's calculated as
	// `bias = vaddr_in_proc - vaddr_in_elf`.
	// Adding the bias to a VA in ELF space translates it into process space.
	Bias uint64

	// Length represents the memory size of the mapping.
	Length uint64

	// Device number of the backing file
	Device uint64

	// Inode number of the backing file
	Inode uint64

	// File offset of the backing file
	FileOffset uint64
}

Mapping represents an executable memory mapping of a process.

func (*Mapping) GetOnDiskFileIdentifier

func (m *Mapping) GetOnDiskFileIdentifier() util.OnDiskFileIdentifier

GetOnDiskFileIdentifier returns the OnDiskFileIdentifier for the mapping

type ProcessManager

type ProcessManager struct {

	// FileIDMapper provides a cache that implements the FileIDMapper interface. The tracer writes
	// the 64-bit to 128-bit file ID mapping to the cache, as this is where the two values are
	// created. The attached interpreters read from the cache when converting traces prior to
	// sending to the collection agent. The cache resides in this package instead of the ebpf
	// package to prevent circular imports.
	FileIDMapper FileIDMapper
	// contains filtered or unexported fields
}

ProcessManager is responsible for managing the events happening throughout the lifespan of a process.

func New

func New(ctx context.Context, includeTracers types.IncludedTracers, monitorInterval time.Duration,
	ebpf pmebpf.EbpfHandler, fileIDMapper FileIDMapper, symbolReporter reporter.SymbolReporter,
	sdp nativeunwind.StackDeltaProvider, filterErrorFrames bool) (*ProcessManager, error)

New creates a new ProcessManager which is responsible for keeping track of loading and unloading of symbols for processes.

Three external interfaces are used to access the processes and related resources: ebpf, fileIDMapper and symbolReporter. Specify nil for fileIDMapper to use the default implementation.

func (*ProcessManager) AddSynthIntervalData

func (pm *ProcessManager) AddSynthIntervalData(fileID host.FileID,
	data sdtypes.IntervalData) error

AddSynthIntervalData adds synthetic stack deltas to the manager. This is useful for cases where populating the information via the stack delta provider isn't viable, for example because the `.eh_frame` section for a binary is broken. If `AddSynthIntervalData` was called for a given file ID, the stack delta provider will not be consulted and the manually added stack deltas take precedence.

func (*ProcessManager) CleanupPIDs

func (pm *ProcessManager) CleanupPIDs()

CleanupPIDs executes a periodic synchronization of pidToProcessInfo table with system processes. NOTE: Exported only for tracer.

func (*ProcessManager) Close

func (pm *ProcessManager) Close()

func (*ProcessManager) ConvertTrace

func (pm *ProcessManager) ConvertTrace(trace *host.Trace) (newTrace *libpf.Trace)

func (*ProcessManager) MaybeNotifyAPMAgent

func (pm *ProcessManager) MaybeNotifyAPMAgent(
	rawTrace *host.Trace, umTraceHash libpf.TraceHash, count uint16) string

func (*ProcessManager) ProcessPIDExit

func (pm *ProcessManager) ProcessPIDExit(pid libpf.PID) bool

ProcessPIDExit informs the ProcessManager that a process exited and no longer will be scheduled for processing. It also schedules immediate symbolization if the exited PID needs it. exitKTime is stored for later processing in SymbolizationComplete when all traces have been collected. There can be a race condition if we can not clean up the references for this process fast enough and this particular pid is reused again by the system. NOTE: Exported only for tracer.

func (*ProcessManager) SymbolizationComplete

func (pm *ProcessManager) SymbolizationComplete(traceCaptureKTime times.KTime)

func (*ProcessManager) SynchronizeProcess

func (pm *ProcessManager) SynchronizeProcess(pr process.Process)