proctree

package
v0.23.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 18, 2025 License: Apache-2.0 Imports: 23 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	DefaultProcessCacheSize = 10928
	DefaultThreadCacheSize  = 21856
)
View Source 
const (
	AllPIDs = 0
)
View Source 
const COMM_LEN = 16
View Source 
const MaxPathLen = 1024

Paths theoretically has no limit, but we do need to set a limit for the sake of managing memory more responsibly.

View Source 
const ProcfsClockId = traceetime.CLOCK_BOOTTIME // Procfs uses jiffies, which are based on boottime

Variables

This section is empty.

Functions

This section is empty.

Types

type DataSource 

type DataSource struct {
	// contains filtered or unexported fields
}

DataSource is an implementation to detect.Datasource interface, enveloping the ProcessTree type.

func NewDataSource 

func NewDataSource(processTree *ProcessTree) *DataSource

func (*DataSource) Get 

func (ptds *DataSource) Get(key interface{}) (map[string]interface{}, error)

Get retrieves information from DataSource based on the provided key. It supports keys of the following types:

- datasource.ProcKey (for process information retrieval) - datasource.ThreadKey (for thread information retrieval) - datasource.LineageKey (for process lineage information retrieval)

and returns an error if the data isn't found.

func (*DataSource) ID 

func (ptds *DataSource) ID() string

ID returns the ID of the DataSource.

func (*DataSource) Keys 

func (ptds *DataSource) Keys() []string

Keys returns a list of supported keys by the DataSource.

func (*DataSource) Namespace 

func (ptds *DataSource) Namespace() string

Namespace returns the namespace of the DataSource.

func (*DataSource) Schema 

func (ptds *DataSource) Schema() string

Schema returns the schema of the DataSource.

func (*DataSource) Version 

func (ptds *DataSource) Version() uint

Version returns the version of the DataSource.

type ExecFeed 

type ExecFeed struct {
	TimeStamp         uint64
	StartTime         uint64
	Inode             uint64
	Ctime             uint64
	CmdPath           string
	PathName          string
	Interp            string
	StdinPath         string
	Pid               int32
	Tid               int32
	PPid              int32
	HostPid           int32
	HostTid           int32
	HostPPid          int32
	TaskHash          uint32
	ParentHash        uint32
	LeaderHash        uint32
	Dev               uint32
	InvokedFromKernel bool

	InodeMode uint16
	StdinType uint16
	// contains filtered or unexported fields
}

type ExitFeed 

type ExitFeed struct {
	TimeStamp  uint64
	TaskHash   uint32
	ExitCode   int32
	SignalCode int32
	Group      bool
	// contains filtered or unexported fields
}

type FileInfo 

type FileInfo struct {
	// contains filtered or unexported fields
}

FileInfo represents a file.

func NewFileInfo 

func NewFileInfo() *FileInfo

NewFileInfo creates a new file.

func NewFileInfoFeed 

func NewFileInfoFeed(feed *FileInfoFeed) *FileInfo

NewFileInfoFeed creates a new file with values from the given feed.

func (*FileInfo) GetCtime 

func (fi *FileInfo) GetCtime() uint64

GetCtime returns the creation time of the file.

func (*FileInfo) GetCtimeAt 

func (fi *FileInfo) GetCtimeAt(targetTime time.Time) uint64

GetCtimeAt returns the creation time of the file at the given time.

func (*FileInfo) GetDev 

func (fi *FileInfo) GetDev() uint32

GetDev returns the device number of the file.

func (*FileInfo) GetDevAt 

func (fi *FileInfo) GetDevAt(targetTime time.Time) uint32

GetDevAt returns the device number of the file at the given time.

func (*FileInfo) GetFeed 

func (fi *FileInfo) GetFeed() FileInfoFeed

GetFeed returns the values of the file as a feed.

func (*FileInfo) GetFeedAt 

func (fi *FileInfo) GetFeedAt(targetTime time.Time) FileInfoFeed

GetFeedAt returns the values of the file as a feed at the given time.

func (*FileInfo) GetInode 

func (fi *FileInfo) GetInode() uint64

GetInode returns the inode number of the file.

func (*FileInfo) GetInodeAt 

func (fi *FileInfo) GetInodeAt(targetTime time.Time) uint64

GetInodeAt returns the inode number of the file at the given time.

func (*FileInfo) GetInodeMode 

func (fi *FileInfo) GetInodeMode() uint16

GetInodeMode returns the inode mode of the file.

func (*FileInfo) GetInodeModeAt 

func (fi *FileInfo) GetInodeModeAt(targetTime time.Time) uint16

GetInodeModeAt returns the inode mode of the file at the given time.

func (*FileInfo) GetPath 

func (fi *FileInfo) GetPath() string

GetPath returns the path of the file.

func (*FileInfo) GetPathAt 

func (fi *FileInfo) GetPathAt(targetTime time.Time) string

GetPathAt returns the path of the file at the given time.

func (*FileInfo) SetFeed 

func (fi *FileInfo) SetFeed(feed *FileInfoFeed)

SetFeed sets the values of the file from a feed at the current time.

func (*FileInfo) SetFeedAt 

func (fi *FileInfo) SetFeedAt(feed *FileInfoFeed, targetTime time.Time)

SetFeedAt sets the values of the file from a feed at the given time.

type FileInfoFeed 

type FileInfoFeed struct {
	// Name      string
	Path      string // mutable (file path)
	Dev       uint32 // mutable (device number)
	InodeMode uint16 // mutable (inode mode)

	Ctime uint64 // mutable (creation time)
	Inode uint64 // mutable (inode number)
	// contains filtered or unexported fields
}

FileInfoFeed allows external packages to set/get multiple values of a task at once.

type ForkFeed 

type ForkFeed struct {
	TimeStamp       uint64
	ParentStartTime uint64
	LeaderStartTime uint64
	ChildStartTime  uint64
	ChildHash       uint32
	ParentHash      uint32
	LeaderHash      uint32
	ParentTid       int32
	ParentNsTid     int32
	ParentPid       int32
	ParentNsPid     int32
	LeaderTid       int32
	LeaderNsTid     int32
	LeaderPid       int32
	LeaderNsPid     int32
	ChildTid        int32
	ChildNsTid      int32
	ChildPid        int32
	ChildNsPid      int32
	// contains filtered or unexported fields
}

type ProcTreeConfig 

type ProcTreeConfig struct {
	Source               SourceType
	ProcessCacheSize     int
	ThreadCacheSize      int
	ProcfsInitialization bool // Determine whether to scan procfs data for process tree initialization
	ProcfsQuerying       bool // Determine whether to query procfs for missing information during runtime
}

type Process 

type Process struct {
	// contains filtered or unexported fields
}

Process represents a process.

func NewProcess 

func NewProcess(hash uint32, info *TaskInfo) *Process

NewProcess creates a new thread with an initialized task info.

func (*Process) GetExecutable 

func (p *Process) GetExecutable() *FileInfo

GetExecutable returns a instanced executable info.

func (*Process) GetHash 

func (p *Process) GetHash() uint32

GetHash returns the hash of the process.

func (*Process) GetInfo 

func (p *Process) GetInfo() *TaskInfo

GetInfo returns a instanced task info.

func (*Process) GetParentHash 

func (p *Process) GetParentHash() uint32

GetParentHash returns the hash of the parent.

func (*Process) SetParentHash 

func (p *Process) SetParentHash(parentHash uint32)

SetParentHash sets the hash of the parent.

type ProcessTree 

type ProcessTree struct {
	// contains filtered or unexported fields
}

ProcessTree is a tree of processes and threads.

func NewProcessTree 

func NewProcessTree(ctx context.Context, config ProcTreeConfig) (*ProcessTree, error)

NewProcessTree creates a new process tree.

func (*ProcessTree) AddChildToProcess added in v0.23.0 

func (pt *ProcessTree) AddChildToProcess(processHash uint32, childHash uint32)

AddChildToProcess adds a child to a process.

func (*ProcessTree) AddThreadToProcess added in v0.23.0 

func (pt *ProcessTree) AddThreadToProcess(processHash uint32, threadHash uint32)

AddThreadToProcess adds a thread to a process.

func (*ProcessTree) EvictChildren added in v0.23.0 

func (pt *ProcessTree) EvictChildren(processHash uint32)

EvictChildren evicts children from a process.

func (*ProcessTree) EvictThreads added in v0.23.0 

func (pt *ProcessTree) EvictThreads(processHash uint32)

EvictThreads evicts threads from a process.

func (*ProcessTree) FeedFromExec 

func (pt *ProcessTree) FeedFromExec(feed *ExecFeed) error

FeedFromExec feeds the process tree with an exec event.

func (*ProcessTree) FeedFromExit 

func (pt *ProcessTree) FeedFromExit(feed *ExitFeed) error

FeedFromExit feeds the process tree with an exit event.

func (*ProcessTree) FeedFromFork 

func (pt *ProcessTree) FeedFromFork(feed *ForkFeed) error

FeedFromFork feeds the process tree with a fork event.

func (*ProcessTree) FeedFromProcFS 

func (pt *ProcessTree) FeedFromProcFS(givenPid int32) error

FeedFromProcFS feeds the process tree with data from procfs.

func (*ProcessTree) FeedFromProcFSAsync 

func (pt *ProcessTree) FeedFromProcFSAsync(givenPid int32)

FeedFromProcFSAsync feeds the process tree with data from procfs asynchronously.

func (*ProcessTree) GetChildren added in v0.23.0 

func (pt *ProcessTree) GetChildren(processHash uint32) []uint32

GetChildren returns a list of children hashes for a given process hash.

func (*ProcessTree) GetExecFeedFromPool added in v0.23.0 

func (pt *ProcessTree) GetExecFeedFromPool() *ExecFeed

GetExecFeedFromPool returns a ExecFeed from the pool, or creates a new one if the pool is empty. ExecFeed certainly contains old data, so it must be updated before use.

func (*ProcessTree) GetExitFeedFromPool added in v0.23.0 

func (pt *ProcessTree) GetExitFeedFromPool() *ExitFeed

GetExitFeedFromPool returns a ExitFeed from the pool, or creates a new one if the pool is empty. ExitFeed certainly contains old data, so it must be updated before use.

func (*ProcessTree) GetFileInfoFeedFromPool added in v0.23.0 

func (pt *ProcessTree) GetFileInfoFeedFromPool() *FileInfoFeed

GetFileInfoFeedFromPool returns a FileInfoFeed from the pool, or creates a new one if the pool is empty. FileInfoFeed certainly contains old data, so it must be updated before use.

func (*ProcessTree) GetForkFeedFromPool added in v0.23.0 

func (pt *ProcessTree) GetForkFeedFromPool() *ForkFeed

GetForkFeedFromPool returns a ForkFeed from the pool, or creates a new one if the pool is empty. ForkFeed certainly contains old data, so it must be updated before use.

func (*ProcessTree) GetOrCreateProcessByHash 

func (pt *ProcessTree) GetOrCreateProcessByHash(hash uint32) *Process

GetOrCreateProcessByHash returns a process by its hash, or creates a new one if it doesn't exist.

func (*ProcessTree) GetOrCreateThreadByHash 

func (pt *ProcessTree) GetOrCreateThreadByHash(hash uint32) *Thread

GetOrCreateThreadByHash returns a thread by its hash, or creates a new one if it doesn't exist.

func (*ProcessTree) GetProcessByHash 

func (pt *ProcessTree) GetProcessByHash(hash uint32) (*Process, bool)

GetProcessByHash returns a process by its hash.

func (*ProcessTree) GetTaskInfoFeedFromPool added in v0.23.0 

func (pt *ProcessTree) GetTaskInfoFeedFromPool() *TaskInfoFeed

GetTaskInfoFeedFromPool returns a TaskInfoFeed from the pool, or creates a new one if the pool is empty. TaskInfoFeed certainly contains old data, so it must be updated before use.

func (*ProcessTree) GetThreadByHash 

func (pt *ProcessTree) GetThreadByHash(hash uint32) (*Thread, bool)

GetThreadByHash returns a thread by its hash.

func (*ProcessTree) GetThreads added in v0.23.0 

func (pt *ProcessTree) GetThreads(processHash uint32) []uint32

GetThreads returns a list of thread hashes for a given process hash.

func (*ProcessTree) PutExecFeedInPool added in v0.23.0 

func (pt *ProcessTree) PutExecFeedInPool(execFeed *ExecFeed)

PutExecFeedInPool returns a ExecFeed to the pool.

func (*ProcessTree) PutExitFeedInPool added in v0.23.0 

func (pt *ProcessTree) PutExitFeedInPool(exitFeed *ExitFeed)

PutExitFeedInPool returns a ExitFeed to the pool.

func (*ProcessTree) PutFileInfoFeedInPool added in v0.23.0 

func (pt *ProcessTree) PutFileInfoFeedInPool(fileInfoFeed *FileInfoFeed)

PutFileInfoFeedInPool returns a FileInfoFeed to the pool.

func (*ProcessTree) PutForkFeedInPool added in v0.23.0 

func (pt *ProcessTree) PutForkFeedInPool(forkFeed *ForkFeed)

PutForkFeedInPool returns a ForkFeed to the pool.

func (*ProcessTree) PutTaskInfoFeedInPool added in v0.23.0 

func (pt *ProcessTree) PutTaskInfoFeedInPool(taskInfoFeed *TaskInfoFeed)

PutTaskInfoFeedInPool returns a TaskInfoFeed to the pool.

func (*ProcessTree) String 

func (pt *ProcessTree) String() string

String returns a string representation of the process tree.

type SourceType 

type SourceType int
const (
	SourceNone    SourceType = iota // disabled
	SourceSignals                   // event from control plane enrich the process tree
	SourceEvents                    // event from pipeline enrich the process tree
	SourceBoth                      // events from both pipelines enrich the process tree
)

func (SourceType) String 

func (s SourceType) String() string

type TaskInfo 

type TaskInfo struct {
	// contains filtered or unexported fields
}

TaskInfo represents a task.

func NewTaskInfo 

func NewTaskInfo() *TaskInfo

NewTaskInfo creates a new task.

func NewTaskInfoNewFromFeed added in v0.23.0 

func NewTaskInfoNewFromFeed(feed *TaskInfoFeed) *TaskInfo

NewTaskInfoFromFeed creates a new task with values from the given feed.

func (*TaskInfo) GetExitTime 

func (ti *TaskInfo) GetExitTime() time.Time

GetExitTime returns the exit time of the task.

func (*TaskInfo) GetExitTimeNS 

func (ti *TaskInfo) GetExitTimeNS() uint64

GetExitTimeNS returns the exitTime of the task in nanoseconds since epoch

func (*TaskInfo) GetFeed 

func (ti *TaskInfo) GetFeed() TaskInfoFeed

GetFeed returns the values of the task as a feed.

func (*TaskInfo) GetFeedAt 

func (ti *TaskInfo) GetFeedAt(targetTime time.Time) TaskInfoFeed

GetFeedAt returns the values of the task as a feed at the given time.

func (*TaskInfo) GetGid 

func (ti *TaskInfo) GetGid() uint32

GetGid returns the gid of the task.

func (*TaskInfo) GetGidAt 

func (ti *TaskInfo) GetGidAt(targetTime time.Time) uint32

GetGidAt returns the gid of the task at the given time.

func (*TaskInfo) GetName 

func (ti *TaskInfo) GetName() string

GetName returns the name of the task.

func (*TaskInfo) GetNameAt 

func (ti *TaskInfo) GetNameAt(targetTime time.Time) string

GetNameAt returns the name of the task at the given time.

func (*TaskInfo) GetNsPPid 

func (ti *TaskInfo) GetNsPPid() int32

GetNsPPid returns the nsPPid of the task.

func (*TaskInfo) GetNsPPidAt 

func (ti *TaskInfo) GetNsPPidAt(targetTime time.Time) int32

GetNsPPidAt returns the nsPPid of the task at the given time.

func (*TaskInfo) GetNsPid 

func (ti *TaskInfo) GetNsPid() int32

GetNsPid returns the nsPid of the task.

func (*TaskInfo) GetNsTid 

func (ti *TaskInfo) GetNsTid() int32

GetNsTid returns the nsTid of the task.

func (*TaskInfo) GetPPid 

func (ti *TaskInfo) GetPPid() int32

GetPPid returns the ppid of the task.

func (*TaskInfo) GetPPidAt 

func (ti *TaskInfo) GetPPidAt(targetTime time.Time) int32

GetPPidAt returns the ppid of the task at the given time.

func (*TaskInfo) GetPid 

func (ti *TaskInfo) GetPid() int32

GetPid returns the pid of the task.

func (*TaskInfo) GetStartTime 

func (ti *TaskInfo) GetStartTime() time.Time

GetStartTime returns the start time of the task.

func (*TaskInfo) GetStartTimeNS 

func (ti *TaskInfo) GetStartTimeNS() uint64

GetStartTimeNS returns the start time of the task in nanoseconds since epoch

func (*TaskInfo) GetTid 

func (ti *TaskInfo) GetTid() int32

GetTid returns the tid of the task.

func (*TaskInfo) GetUid 

func (ti *TaskInfo) GetUid() uint32

GetUid returns the uid of the task.

func (*TaskInfo) GetUidAt 

func (ti *TaskInfo) GetUidAt(targetTime time.Time) uint32

GetUidAt returns the uid of the task at the given time.

func (*TaskInfo) IsAlive 

func (ti *TaskInfo) IsAlive() bool

IsAlive returns true if the task has exited.

func (*TaskInfo) IsAliveAt 

func (ti *TaskInfo) IsAliveAt(targetTime time.Time) bool

IsAliveAt return whether the task is alive in the given time, either because it didn't start yet or it has exited.

func (*TaskInfo) SetExitTime 

func (ti *TaskInfo) SetExitTime(exitTime uint64)

SetExitTime sets the exitTime of the task.

func (*TaskInfo) SetFeed 

func (ti *TaskInfo) SetFeed(feed *TaskInfoFeed)

SetFeed sets the values of the task from the given feed at the current time.

func (*TaskInfo) SetFeedAt 

func (ti *TaskInfo) SetFeedAt(feed *TaskInfoFeed, targetTime time.Time)

SetFeedAt sets the values of the task from the given feed at the given time.

func (*TaskInfo) SetNameAt 

func (ti *TaskInfo) SetNameAt(name string, targetTime time.Time)

SetNameAt sets the name of the task at the given time.

type TaskInfoFeed 

type TaskInfoFeed struct {
	Name        string // mutable (process name can be changed)
	Tid         int32  // immutable
	Pid         int32  // immutable
	PPid        int32  // mutable (process can be reparented)
	NsTid       int32  // immutable
	NsPid       int32  // immutable
	NsPPid      int32  // mutable (process can be reparented)
	Uid         uint32 // mutable (process uid can be changed)
	Gid         uint32 // mutable (process gid can be changed)
	StartTimeNS uint64 // immutable (this is a duration, in ns, since boot)
	ExitTimeNS  uint64 // immutable (this is a duration, in ns, since boot)
}

TaskInfoFeed allows external packages to set/get multiple values of a task at once.

type Thread 

type Thread struct {
	// contains filtered or unexported fields
}

Thread represents a thread.

func NewThread 

func NewThread(hash uint32, info *TaskInfo) *Thread

NewThread creates a new thread with an initialized task info.

func (*Thread) GetHash 

func (t *Thread) GetHash() uint32

GetHash returns the hash of the thread.

func (*Thread) GetInfo 

func (t *Thread) GetInfo() *TaskInfo

GetInfo returns a instanced task info.

func (*Thread) GetLeaderHash 

func (t *Thread) GetLeaderHash() uint32

GEtLeaderHash returns the hash of the thread group leader.

func (*Thread) GetParentHash 

func (t *Thread) GetParentHash() uint32

GetParentHash returns the hash of the parent.

func (*Thread) SetLeaderHash 

func (t *Thread) SetLeaderHash(leaderHash uint32)

SetLeaderHash sets the hash of the thread group leader.

func (*Thread) SetParentHash 

func (t *Thread) SetParentHash(parentHash uint32)

SetParentHash sets the hash of the parent.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.