sensor

package
v0.15.0-alpha Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 21, 2018 License: Apache-2.0 Imports: 39 Imported by: 22

Documentation

Index

Constants

View Source 
const (

	/*
	 * cloning flags:
	 */
	CSIGNAL              = 0x000000ff /* signal mask to be sent at exit */
	CLONE_VM             = 0x00000100 /* set if VM shared between processes */
	CLONE_FS             = 0x00000200 /* set if fs info shared between processes */
	CLONE_FILES          = 0x00000400 /* set if open files shared between processes */
	CLONE_SIGHAND        = 0x00000800 /* set if signal handlers and blocked signals shared */
	CLONE_PTRACE         = 0x00002000 /* set if we want to let tracing continue on the child too */
	CLONE_VFORK          = 0x00004000 /* set if the parent wants the child to wake it up on mm_release */
	CLONE_PARENT         = 0x00008000 /* set if we want to have the same parent as the cloner */
	CLONE_THREAD         = 0x00010000 /* Same thread group? */
	CLONE_NEWNS          = 0x00020000 /* New mount namespace group */
	CLONE_SYSVSEM        = 0x00040000 /* share system V SEM_UNDO semantics */
	CLONE_SETTLS         = 0x00080000 /* create a new TLS for the child */
	CLONE_PARENT_SETTID  = 0x00100000 /* set the TID in the parent */
	CLONE_CHILD_CLEARTID = 0x00200000 /* clear the TID in the child */
	CLONE_DETACHED       = 0x00400000 /* Unused, ignored */
	CLONE_UNTRACED       = 0x00800000 /* set if the tracing process can't force CLONE_PTRACE on this clone */
	CLONE_CHILD_SETTID   = 0x01000000 /* set the TID in the child */
	CLONE_NEWCGROUP      = 0x02000000 /* New cgroup namespace */
	CLONE_NEWUTS         = 0x04000000 /* New utsname namespace */
	CLONE_NEWIPC         = 0x08000000 /* New ipc namespace */
	CLONE_NEWUSER        = 0x10000000 /* New user namespace */
	CLONE_NEWPID         = 0x20000000 /* New pid namespace */
	CLONE_NEWNET         = 0x40000000 /* New network namespace */
	CLONE_IO             = 0x80000000 /* Clone io context */
)

Variables

View Source 
var ContainerStateNames = map[ContainerState]string{
	ContainerStateCreated:    "created",
	ContainerStateRestarting: "restarting",
	ContainerStateRunning:    "running",
	ContainerStateRemoving:   "removing",
	ContainerStatePaused:     "paused",
	ContainerStateExited:     "exited",
}

ContainerStateNames is a mapping of container states to printable names.

Functions

func Main 

func Main()

Main is the main entrypoint for the sensor

Types

type ContainerCache 

type ContainerCache struct {
	sync.Mutex

	// These are external event IDs registered with the sensor's event
	// monitor instance. The cache will enqueue these events as appropriate
	// as the cache is updated.
	ContainerCreatedEventID   uint64 // api.ContainerEventType_CONTAINER_EVENT_TYPE_CREATED
	ContainerRunningEventID   uint64 // api.ContainerEventType_CONTAINER_EVENT_TYPE_RUNNING
	ContainerExitedEventID    uint64 // api.ContainerEventType_CONTAINER_EVENT_TYPE_EXITED
	ContainerDestroyedEventID uint64 // api.ContainerEventType_CONTAINER_EVENT_TYPE_DESTROYED
	ContainerUpdatedEventID   uint64 // api.ContainerEventType_CONTAINER_EVENT_TYPE_UPDATED
	// contains filtered or unexported fields
}

ContainerCache is a cache of container information

func NewContainerCache 

func NewContainerCache(sensor *Sensor) *ContainerCache

NewContainerCache creates a new container cache.

func (*ContainerCache) DeleteContainer 

func (cc *ContainerCache) DeleteContainer(
	containerID string,
	runtime ContainerRuntime,
	sampleID perf.SampleID,
)

DeleteContainer removes a container from the cache.

func (*ContainerCache) LookupContainer 

func (cc *ContainerCache) LookupContainer(containerID string, create bool) *ContainerInfo

LookupContainer searches the cache for a container by ID and returns any information found, optionally creating a cache entry if there is one does not already exist.

type ContainerInfo 

type ContainerInfo struct {
	ID        string
	Name      string
	ImageID   string
	ImageName string

	Pid      int
	ExitCode int

	Runtime ContainerRuntime
	State   ContainerState

	JSONConfig string
	OCIConfig  string
	// contains filtered or unexported fields
}

ContainerInfo records interesting information known about a container.

func (*ContainerInfo) Update 

func (info *ContainerInfo) Update(
	runtime ContainerRuntime,
	sampleID perf.SampleID,
	data map[string]interface{},
)

Update updates the data cached for a container with new information. Some new information may trigger telemetry events to fire.

type ContainerRuntime 

type ContainerRuntime uint

ContainerRuntime represents the runtime used to manager a container 

const (
	// ContainerRuntimeUnknown means the container runtime managing the
	// container is unknown. Information about the container comes from
	// runc, the kernel, or other generic sources.
	ContainerRuntimeUnknown ContainerRuntime = iota

	// ContainerRuntimeDocker means the container is managed by Docker.
	ContainerRuntimeDocker
)

type ContainerState 

type ContainerState uint

ContainerState represents the state of a container (created, running, etc.) 

const (
	// ContainerStateUnknown indicates that the container is in an unknown
	// state.
	ContainerStateUnknown ContainerState = iota

	// ContainerStateCreated indicates the container exists, but is not
	// running.
	ContainerStateCreated

	// ContainerStatePaused indicates the container is paused.
	ContainerStatePaused

	// ContainerStateRunning indicates the container is running.
	ContainerStateRunning

	// ContainerStateRestarting indicates the container is in the process
	// of restarting.
	ContainerStateRestarting

	// ContainerStateExited indicates the container has exited.
	ContainerStateExited

	// ContainerStateRemoving indicates the container is being removed.
	ContainerStateRemoving
)

type Cred 

type Cred struct {
	// UID is the real UID
	UID uint32
	// GID is the real GID
	GID uint32
	// EUID is the effective UID
	EUID uint32
	// EGID is the effective GID
	EGID uint32
	// SUID is the saved UID
	SUID uint32
	// SGID is the saved GID
	SGID uint32
	// FSUID is the UID for filesystem operations
	FSUID uint32
	// FSGID is the GID for filesystem operations
	FSGID uint32
}

Cred contains task credential information

type MetricsCounters 

type MetricsCounters struct {
	// Number of events created during the sample period
	Events uint64

	// Number of subscriptions
	Subscriptions int32
}

MetricsCounters is used for tracking metrics information in the sensor

type ProcessInfoCache 

type ProcessInfoCache struct {

	// These are external event IDs registered with the sensor's event
	// monitor instance. The cache will enqueue these events as appropriate
	// as the cache is updated.
	ProcessExecEventID   uint64 // api.ProcessEventType_PROCESS_EVENT_TYPE_EXEC
	ProcessForkEventID   uint64 // api.ProcessEventType_PROCESS_EVENT_TYPE_FORK
	ProcessExitEventID   uint64 // api.ProcessEventType_PROCESS_EVENT_TYPE_EXIT
	ProcessUpdateEventID uint64 // api.ProcessEventType_PROCESS_EVENT_TYPE_UPDATE
	// contains filtered or unexported fields
}

ProcessInfoCache is an object that caches process information. It is maintained automatically via an existing sensor object.

func NewProcessInfoCache 

func NewProcessInfoCache(sensor *Sensor) *ProcessInfoCache

NewProcessInfoCache creates a new process information cache object. An existing sensor object is required in order for the process info cache to able to install its probes to monitor the system to maintain the cache.

func (*ProcessInfoCache) LookupTask 

func (pc *ProcessInfoCache) LookupTask(pid int) *Task

LookupTask finds the task information for the given PID.

func (*ProcessInfoCache) LookupTaskAndLeader 

func (pc *ProcessInfoCache) LookupTaskAndLeader(pid int) (*Task, *Task)

LookupTaskAndLeader finds the task information for both a given PID and the thread group leader.

func (*ProcessInfoCache) LookupTaskContainerInfo 

func (pc *ProcessInfoCache) LookupTaskContainerInfo(t *Task) *ContainerInfo

LookupTaskContainerInfo returns the container info for a task, possibly consulting the sensor's container cache and updating the task cached information.

func (*ProcessInfoCache) Start 

func (pc *ProcessInfoCache) Start()

Start enables the process cache by scanning the /proc filesystem to learn about existing processes and enable monitoring once that is done.

type Sensor 

type Sensor struct {
	// Unique Id for this sensor. Sensor Ids are ephemeral.
	ID string

	// Metrics counters for this sensor
	Metrics MetricsCounters

	// A sensor-global event monitor that is used for events to aid in
	// caching process information
	Monitor *perf.EventMonitor

	// Per-sensor caches and monitors
	ProcessCache   *ProcessInfoCache
	ContainerCache *ContainerCache
	// contains filtered or unexported fields
}

Sensor represents the state of a sensor instance.

func NewSensor 

func NewSensor() (*Sensor, error)

NewSensor creates a new Sensor instance.

func (*Sensor) IsKernelSymbolAvailable 

func (s *Sensor) IsKernelSymbolAvailable(symbol string) bool

IsKernelSymbolAvailable checks to see if the specified kprobe symbol is available for use in the running kernel.

func (*Sensor) NewEvent 

func (s *Sensor) NewEvent() *api.TelemetryEvent

NewEvent creates a new API Event instance with common sensor-specific fields correctly populated.

func (*Sensor) NewEventFromContainer 

func (s *Sensor) NewEventFromContainer(containerID string) *api.TelemetryEvent

NewEventFromContainer creates a new API Event instance using a specific container ID.

func (*Sensor) NewEventFromSample 

func (s *Sensor) NewEventFromSample(
	sample *perf.SampleRecord,
	data perf.TraceEventSampleData,
) *api.TelemetryEvent

NewEventFromSample creates a new API Event instance using perf_event sample information. If the sample comes from the calling process, no event will be created, and the return will be nil.

func (*Sensor) NewSubscription 

func (s *Sensor) NewSubscription(
	ctx context.Context,
	sub *api.Subscription,
	dispatchFn eventSinkDispatchFn,
) ([]*google_rpc.Status, error)

NewSubscription creates a new telemetry subscription from the given api.Subscription descriptor. Canceling the specified context will cancel the subscription. For each event matching the subscription, the specified dispatch functional will be called.

func (*Sensor) RegisterKprobe 

func (s *Sensor) RegisterKprobe(
	address string,
	onReturn bool,
	output string,
	fn perf.TraceEventDecoderFn,
	options ...perf.RegisterEventOption,
) (uint64, error)

RegisterKprobe registers a kprobe with the sensor's EventMonitor instance, but before doing so, ensures that the kernel symbol is available.

func (*Sensor) Start 

func (s *Sensor) Start() error

Start starts a sensor instance running.

func (*Sensor) Stop 

func (s *Sensor) Stop()

Stop stops a running sensor instance.

type Task 

type Task struct {
	// PID is the kernel's internal process identifier, which is equivalent
	// to the TID in userspace.
	PID int

	// TGID is the kernel's internal thread group identifier, which is
	// equivalent to the PID in userspace. All threads within a process
	// have differing PIDs, but all share the same TGID. The thread group
	// leader process's PID will be the same as its TGID.
	TGID int

	// Command is the kernel's comm field, which is initialized to the
	// first 15 characters of the basename of the executable being run.
	// It is also set via pthread_setname_np(3) and prctl(2) PR_SET_NAME.
	// It is always NULL-terminated and no longer than 16 bytes (including
	// NUL byte).
	Command string

	// CommandLine is the command-line used when the process was exec'd via
	// execve(). It is composed of the first 6 elements of argv. It may
	// not be complete if argv contained more than 6 elements.
	CommandLine []string

	// Creds are the credentials (uid, gid) for the task. This is kept
	// up-to-date by recording changes observed via a kprobe on
	// commit_creds().
	Creds *Cred

	// ContainerID is the ID of the container to which the task belongs,
	// if any.
	ContainerID string

	// ContainerInfo is a pointer to the cached container information for
	// the container to which the task belongs, if any.
	ContainerInfo *ContainerInfo

	// StartTime is the time at which a task started.
	StartTime int64

	// ExitTime is the time at which a task exited.
	ExitTime int64

	// ProcessID is a unique ID for the task.
	ProcessID string

	// CWD is the current working directory for the task. Tasks within a
	// process can each have their own independent CWD.
	CWD string
	// contains filtered or unexported fields
}

Task represents a schedulable task. All Linux tasks are uniquely identified at a given time by their PID, but those PIDs may be reused after hitting the maximum PID value.

func (*Task) IsSensor 

func (t *Task) IsSensor() bool

IsSensor returns true if the task belongs to the sensor process.

func (*Task) Leader 

func (t *Task) Leader() *Task

Leader returns a reference to a task's leader task.

func (*Task) Parent 

func (t *Task) Parent() *Task

Parent returns a reference to a task's parent task.

func (*Task) Update 

func (t *Task) Update(data map[string]interface{}, timestamp uint64) bool

Update updates a task instance with new data. It returns true if any data was actually changed.

type TelemetryService 

type TelemetryService struct {
	// contains filtered or unexported fields
}

TelemetryService is a service that can be used with the ServiceManager to process telemetry subscription requests and stream the resulting telemetry events.

func NewTelemetryService 

func NewTelemetryService(
	sensor *Sensor,
	address string,
	options ...TelemetryServiceOption,
) *TelemetryService

NewTelemetryService creates a new TelemetryService instance that can be used with a ServiceManager instance.

func (*TelemetryService) Name 

func (ts *TelemetryService) Name() string

Name returns the human-readable name of the TelemetryService.

func (*TelemetryService) Serve 

func (ts *TelemetryService) Serve() error

Serve is the main entrypoint for the TelemetryService. It is normally called by the ServiceManager. It will service requests indefinitely from the calling Goroutine.

func (*TelemetryService) Stop 

func (ts *TelemetryService) Stop()

Stop will stop a running TelemetryService.

type TelemetryServiceGetEventsRequestFunc 

type TelemetryServiceGetEventsRequestFunc func(
	request *api.GetEventsRequest,
)

TelemetryServiceGetEventsRequestFunc is a function called when a new subscription is requested.

type TelemetryServiceGetEventsResponseFunc 

type TelemetryServiceGetEventsResponseFunc func(
	response *api.GetEventsResponse,
	err error,
)

TelemetryServiceGetEventsResponseFunc is a function called when a new subscscription is processed. The response will be included or an error if there was an error processing the subscription.

type TelemetryServiceOption 

type TelemetryServiceOption func(*telemetryServiceOptions)

TelemetryServiceOption is used to implement optional arguments for NewTelemetryService. It must be exported, but it is not typically used directly.

func WithGetEventsRequestFunc 

func WithGetEventsRequestFunc(f TelemetryServiceGetEventsRequestFunc) TelemetryServiceOption

WithGetEventsRequestFunc specifies a function to be called when a telemetry service GetEvents request has been received. It is called with the request.

func WithGetEventsResponseFunc 

func WithGetEventsResponseFunc(f TelemetryServiceGetEventsResponseFunc) TelemetryServiceOption

WithGetEventsResponseFunc sepecifies a function to be called when a telemtry service GetEvents request has been processed. It is called with either the response or an error.

func WithStartFunc 

func WithStartFunc(f TelemetryServiceStartFunc) TelemetryServiceOption

WithStartFunc specifies a function to be called when a telemetry service is started.

func WithStopFunc 

func WithStopFunc(f TelemetryServiceStopFunc) TelemetryServiceOption

WithStopFunc specifies a function to be called when a telemetry service is stopped.

type TelemetryServiceStartFunc 

type TelemetryServiceStartFunc func()

TelemetryServiceStartFunc is a function called when the sensor service is started.

type TelemetryServiceStopFunc 

type TelemetryServiceStopFunc func()

TelemetryServiceStopFunc is a function called when the sensor service is stopped.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.