-
Notifications
You must be signed in to change notification settings - Fork 359
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: include ancestors in process events #2938
base: main
Are you sure you want to change the base?
Conversation
✅ Deploy Preview for tetragon ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
Hello. Upd: found even more problems, converting back to draft for now. |
I'll look shortly sorry was travelling and then catching up. Should be able to get to this today or tomorrow thanks! |
Allow to include ancestors of the process beyond the immediate parent (up to PID 1 / PID 2) in process_exec, process_exit, process_uprobe, process_kprobe, process_lsm, process_tracepoint events via `--enable-process-ancestors` option. Turn `--enable-process-ancestors` option off by default. Signed-off-by: t0x01 <[email protected]>
Implement a new export filter that can filter over ancestor binary names using RE2 regular expressions. Signed-off-by: t0x01 <[email protected]>
Add information about ancestors, ancestor filter and ancestors related metrics to documentation. Signed-off-by: t0x01 <[email protected]>
e2e9ea1
to
558ee86
Compare
I think i misunderstood the purpose of both So now there seems to be no real reason to return And there is still inconsistency in the ancestors field's value across protobuf messages in api/v1/tetragon/tetragon.proto and vendor/github.com/cilium/tetragon/api/v1/tetragon/tetragon.proto. I'm still not sure how to properly handle that. @jrfastab, may I ask you for a code review now? Sorry for the delay. |
Fixes 2420
Description
Reason: Option to include all ancestors of the process in process events can be very useful for observability and filtering purposes. E.g. to apply complex correlation rules later in data processing pipeline, or to filter out extra events.
Changes made:
enable-process-ancestors
from the config file. Turn optionenable-process-ancestors
off by default.enable-process-ancestors
is set, try to include ancestors (up to PID 1/PID 2) of the process beyond the immediate parent inprocess_exec
,process_exit
,process_uprobe
,process_kprobe
,process_lsm
,process_tracepoint
events in a respective protobuf message for the given process.enable-process-ancestors
is set and there was an error when trying to include process' ancestors in the protobuf message, add the event to eventcache for reprocessing.enable-process-ancestors
is set andAncestors
is nil, try to include process' ancestors again.