Documentation
¶
Overview ¶
Package process holds the process trace kinds: process_tree records each process under a root as it starts, changes and exits, and process_samples records the CPU, memory, disk IO and armed facets of every one of them at each tick.
Index ¶
- Constants
- Variables
- func Key(p clickyprocess.Process) string
- func NewSamplesKind(sampler *Sampler) *tracing.Handler[SampleParams, Sample]
- func NewTreeKind(sampler *Sampler, options TreeOptions) *tracing.Handler[TreeParams, Node]
- func ParseKey(key string) (int, error)
- type EnvironmentParams
- type Node
- type Params
- type Sample
- type SampleCheckpoint
- type SampleParams
- type Sampler
- type StackTransport
- type TransportLister
- type TreeOptions
- type TreeParams
Constants ¶
const ( // FacetOpenFiles are the descriptors that are no socket. FacetOpenFiles = "openFiles" // FacetSockets are the internet and unix-domain sockets. FacetSockets = "sockets" // FacetPorts are the sockets listening on a port. FacetPorts = "ports" // FacetConnections are the TCP and UDP sockets with a peer. FacetConnections = "connections" )
The facets process_samples reads of each process's open descriptors.
const ( TreeKind = "process_tree" SamplesKind = "process_samples" )
TreeKind and SamplesKind are the names a host registers the kinds as.
const MinInterval = 250 * time.Millisecond
MinInterval is the shortest tick a capture takes: each tick lists every process on the host.
Variables ¶
var Facets = []string{FacetOpenFiles, FacetSockets, FacetPorts, FacetConnections}
Facets are every facet a capture can arm.
Functions ¶
func Key ¶
func Key(p clickyprocess.Process) string
Key identifies a process across ticks, and tells apart two processes that held one pid: its pid and the second it started. A process whose start is unknown is keyed by its pid alone.
func NewSamplesKind ¶
func NewSamplesKind(sampler *Sampler) *tracing.Handler[SampleParams, Sample]
NewSamplesKind is the process_samples kind over sampler, whose sessions can follow the samples as they are taken.
func NewTreeKind ¶
func NewTreeKind(sampler *Sampler, options TreeOptions) *tracing.Handler[TreeParams, Node]
NewTreeKind is the process_tree kind over sampler: each process stored once and replaced as it changes, its secrets masked and its values cut at 64KiB.
Types ¶
type EnvironmentParams ¶
type EnvironmentParams struct {
Keys []string `json:"keys,omitempty"`
Prefixes []string `json:"prefixes,omitempty"`
}
EnvironmentParams name the environment variables a node is read with.
type Node ¶
type Node struct {
tracing.Truncation
Key string `json:"key" pretty:"hide" filter:"exact"`
ParentKey string `json:"parentKey,omitempty" pretty:"hide" filter:"exact"`
PID int `json:"pid" pretty:"label=PID" filter:"terms"`
PPID int `json:"ppid" pretty:"label=PPID"`
Name string `json:"name" filter:"terms"`
Command string `json:"command" filter:"text"`
CWD string `json:"cwd,omitempty" pretty:"label=Cwd"`
Status string `json:"status" filter:"terms"`
IsRoot bool `json:"isRoot,omitempty" pretty:"hide"`
StartedAt time.Time `json:"startedAt" pretty:"label=Started" sort:"startedAt"`
ExitedAt *time.Time `json:"exitedAt,omitempty" pretty:"label=Exited" sort:"exitedAt"`
LastSeenAt time.Time `json:"lastSeenAt" pretty:"hide"`
// CPUPercent is the CPU% over the latest window of at least a second, per
// core; nil until that window has passed. PeakCPUPercent is the highest
// known one.
CPUPercent *float64 `json:"cpuPercent,omitempty" pretty:"label=CPU %" sort:"cpuPercent"`
RSSBytes uint64 `json:"rssBytes" pretty:"label=RSS,type=bytes" sort:"rssBytes"`
PeakCPUPercent *float64 `json:"peakCpuPercent,omitempty" pretty:"label=Peak CPU %" sort:"peakCpuPercent"`
PeakRSSBytes uint64 `json:"peakRssBytes" pretty:"label=Peak RSS,type=bytes" sort:"peakRssBytes"`
// StackTransports are the stack dump transports (the stacks kind's) its
// stacks can be dumped with.
StackTransports []StackTransport `json:"stackTransports,omitempty" pretty:"hide"`
// Environment is the process's environment as its node was created, its
// secrets masked, when the capture reads it (TreeParams.Environment);
// EnvironmentError is why it could not be read.
Environment map[string]string `json:"environment,omitempty" pretty:"hide" filter:"none"`
EnvironmentError string `json:"environmentError,omitempty" pretty:"hide"`
}
Node is one process of the tree as last seen: its stream holds each process once, replaced as it changes, and keeps it after it exits.
type Params ¶
type Params struct {
// RootPID is the process whose tree is captured; zero is the host's own.
RootPID int `json:"rootPid,omitempty" clicky:"title=Root PID"`
// Interval, a duration such as 1s, is how often the tree is sampled.
// Empty is a second.
Interval string `json:"interval,omitempty" clicky:"title=Interval"`
}
Params choose the process tree a capture follows and how often it looks.
type Sample ¶
type Sample struct {
SampledAt time.Time `json:"sampledAt" pretty:"label=Sampled" sort:"sampledAt"`
Tick int64 `json:"tick" sort:"tick"`
Key string `json:"key" pretty:"hide" filter:"exact"`
PID int `json:"pid" pretty:"label=PID" filter:"terms"`
// CPUPercent is the CPU% over the process's latest window of at least a
// second, per core; nil until that window has passed.
CPUPercent *float64 `json:"cpuPercent,omitempty" pretty:"label=CPU %" sort:"cpuPercent"`
MemoryPercent float64 `json:"memoryPercent" pretty:"label=Memory %" sort:"memoryPercent"`
RSSBytes uint64 `json:"rssBytes" pretty:"label=RSS,type=bytes" sort:"rssBytes"`
// DiskReadBytes and DiskWriteBytes are what the process read from and
// wrote to disk since it started; nil when it exited before they were read.
DiskReadBytes *uint64 `json:"diskReadBytes,omitempty" pretty:"label=Disk read,type=bytes" sort:"diskReadBytes"`
DiskWriteBytes *uint64 `json:"diskWriteBytes,omitempty" pretty:"label=Disk written,type=bytes" sort:"diskWriteBytes"`
// The counts of each armed facet (SampleParams.Facets), every tick.
OpenFiles *int `json:"openFiles,omitempty" pretty:"label=Open files" sort:"openFiles"`
Sockets *int `json:"sockets,omitempty" pretty:"label=Sockets" sort:"sockets"`
Ports *int `json:"ports,omitempty" pretty:"label=Ports" sort:"ports"`
Connections *int `json:"connections,omitempty" pretty:"label=Connections" sort:"connections"`
// The lists of each armed facet, at the first tick and at each tick it
// differs from the process's previous stored list; a list that emptied is
// told by its count of 0.
OpenFileList []clickyprocess.Descriptor `json:"openFileList,omitempty" pretty:"hide" filter:"none"`
SocketList []clickyprocess.Descriptor `json:"socketList,omitempty" pretty:"hide" filter:"none"`
PortList []clickyprocess.Descriptor `json:"portList,omitempty" pretty:"hide" filter:"none"`
ConnectionList []clickyprocess.Descriptor `json:"connectionList,omitempty" pretty:"hide" filter:"none"`
}
Sample is one process's usage at one tick: Key is its node's key in the process_tree stream of the same root.
type SampleCheckpoint ¶
type SampleCheckpoint struct {
Key string `json:"key"`
}
SampleCheckpoint is what a process_samples checkpoint reads: a tick at once, with every armed facet's full list for the process Key names.
type SampleParams ¶
type SampleParams struct {
Params
// Facets are read of every process at each tick, with one lsof call for
// the whole tree: each one's count every tick, its list when it changed.
Facets []string `json:"facets,omitempty" clicky:"title=Facets"`
}
SampleParams are the params of process_samples: the tree, and the facets read of every process at each tick.
func (SampleParams) Validate ¶
func (p SampleParams) Validate() error
type Sampler ¶
type Sampler struct {
// contains filtered or unexported fields
}
Sampler lists the host's processes for the captures that share it, so the tree and samples captures of one root cost one listing per tick.
func NewSampler ¶
func NewSampler() *Sampler
type StackTransport ¶
type StackTransport struct {
Transport string `json:"transport"`
Destructive bool `json:"destructive"`
}
StackTransport is a transport a process's stacks can be dumped with, and whether dumping with it kills the process.
type TransportLister ¶
type TransportLister interface {
Transports(pid int) []StackTransport
}
TransportLister lists the stack transports that can dump pid, as the stacks kind's Dumpers do.
type TreeOptions ¶
type TreeOptions struct {
// Dumpers list the stack transports of each node; nil lists none.
Dumpers TransportLister
}
TreeOptions are the host's choices for the process_tree kind.
type TreeParams ¶
type TreeParams struct {
Params
// Environment reads each process's environment once, as its node is
// created, limited to these keys and prefixes; empty ones read all of it.
// Absent reads none.
Environment *EnvironmentParams `json:"environment,omitempty" clicky:"title=Environment"`
}
TreeParams are the params of process_tree: the tree, and which environment variables each process's node is read with.