Help us shape the future of Go! Take the 2026 Go Developer Survey

tracers

package
v0.3.310 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 3, 2026 License: Apache-2.0 Imports: 55 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	SYS_LINKAT    = 265
	SYS_LINK      = 86
	SYS_SYMLINKAT = 266
	SYS_SYMLINK   = 88
	SYS_OPEN      = 2
	SYS_OPENAT    = 257
	SYS_FORK      = 57
)
View Source 
const (
	MaxGroupedEventSize = 10000
	StatusOK            = 200
	StatusBadRequest    = 300
)
View Source 
const (
	SupportedMajor = 6
	SupportedMinor = 4
)

Variables

View Source 
var ConsistentHeaders = []string{
	"Accept-Encoding",
	"Accept-Language",
	"Connection",
	"Host",
	"Upgrade-Insecure-Requests",
}

Functions

func CreateEventFromRequest added in v0.3.3 

func CreateEventFromRequest(bpfEvent utils.HttpRawEvent) (utils.HttpEvent, error)

func ExtractConsistentHeaders added in v0.3.3 

func ExtractConsistentHeaders(headers http.Header) map[string][]string

func FromCString added in v0.3.3 

func FromCString(in []byte) []byte

func GetPacketDirection added in v0.3.3 

func GetPacketDirection(syscall string) (consts.NetworkDirection, error)

func GetValidBuf added in v0.3.60 

func GetValidBuf(event utils.HttpRawEvent) []byte

GetValidBuf returns only the valid portion of the BPF event buffer. It uses buf_len set by the gadget to determine the actual data length.

func NewDnsOperator added in v0.3.3 

func NewDnsOperator() operators.DataOperator

func NewExecOperator added in v0.3.3 

func NewExecOperator() operators.DataOperator

func ParseHttpRequest added in v0.3.3 

func ParseHttpRequest(data []byte) (*http.Request, error)

func ParseHttpResponse added in v0.3.3 

func ParseHttpResponse(data []byte, req *http.Request) (*http.Response, error)

func PatchHTTPPacket added in v0.3.3 

func PatchHTTPPacket(data []byte) []byte

func ToTime added in v0.3.3 

func ToTime(t eventtypes.Time) time.Time

Types

type BpfTracer added in v0.3.3 

type BpfTracer struct {
	// contains filtered or unexported fields
}

BpfTracer implements TracerInterface for events

func NewBpfTracer added in v0.3.3 

func NewBpfTracer(
	kubeManager operators.DataOperator,
	runtime runtime.Runtime,
	ociStore *orasoci.ReadOnlyStore,
	eventCallback containerwatcher.ResultCallback,
	thirdPartyEnricher containerwatcher.TaskBasedEnricher,
) *BpfTracer

NewBpfTracer creates a new tracer

func (*BpfTracer) GetEventType added in v0.3.3 

func (bt *BpfTracer) GetEventType() utils.EventType

GetEventType returns the event type this tracer produces

func (*BpfTracer) GetName added in v0.3.3 

func (bt *BpfTracer) GetName() string

GetName returns the unique name of the tracer

func (*BpfTracer) IsEnabled added in v0.3.3 

func (bt *BpfTracer) IsEnabled(cfg config.Config) bool

IsEnabled checks if this tracer should be enabled based on configuration

func (*BpfTracer) Start added in v0.3.3 

func (bt *BpfTracer) Start(ctx context.Context) error

Start initializes and starts the tracer

func (*BpfTracer) Stop added in v0.3.3 

func (bt *BpfTracer) Stop() error

Stop gracefully stops the bpf tracer

type CapabilitiesTracer 

type CapabilitiesTracer struct {
	// contains filtered or unexported fields
}

CapabilitiesTracer implements TracerInterface for events

func NewCapabilitiesTracer 

func NewCapabilitiesTracer(
	kubeManager operators.DataOperator,
	runtime runtime.Runtime,
	ociStore *orasoci.ReadOnlyStore,
	eventCallback containerwatcher.ResultCallback,
	thirdPartyEnricher containerwatcher.TaskBasedEnricher,
) *CapabilitiesTracer

NewCapabilitiesTracer creates a new tracer

func (*CapabilitiesTracer) GetEventType 

func (ct *CapabilitiesTracer) GetEventType() utils.EventType

GetEventType returns the event type this tracer produces

func (*CapabilitiesTracer) GetName 

func (ct *CapabilitiesTracer) GetName() string

GetName returns the unique name of the tracer

func (*CapabilitiesTracer) IsEnabled 

func (ct *CapabilitiesTracer) IsEnabled(cfg config.Config) bool

IsEnabled checks if this tracer should be enabled based on configuration

func (*CapabilitiesTracer) Start 

func (ct *CapabilitiesTracer) Start(ctx context.Context) error

Start initializes and starts the tracer

func (*CapabilitiesTracer) Stop 

func (ct *CapabilitiesTracer) Stop() error

Stop gracefully stops the tracer

type DNSTracer 

type DNSTracer struct {
	// contains filtered or unexported fields
}

DNSTracer implements TracerInterface for events

func NewDNSTracer 

func NewDNSTracer(
	kubeManager operators.DataOperator,
	runtime runtime.Runtime,
	ociStore *orasoci.ReadOnlyStore,
	eventCallback containerwatcher.ResultCallback,
	thirdPartyEnricher containerwatcher.TaskBasedEnricher,
	socketEnricherOp *socketenricher.SocketEnricher,
	opts ...DNSTracerOption,
) *DNSTracer

NewDNSTracer creates a new tracer

func (*DNSTracer) GetEventType 

func (dt *DNSTracer) GetEventType() utils.EventType

GetEventType returns the event type this tracer produces

func (*DNSTracer) GetName 

func (dt *DNSTracer) GetName() string

GetName returns the unique name of the tracer

func (*DNSTracer) IsEnabled 

func (dt *DNSTracer) IsEnabled(cfg config.Config) bool

IsEnabled checks if this tracer should be enabled based on configuration

func (*DNSTracer) Start 

func (dt *DNSTracer) Start(ctx context.Context) error

Start initializes and starts the tracer

func (*DNSTracer) Stop 

func (dt *DNSTracer) Stop() error

Stop gracefully stops the tracer

type DNSTracerOption added in v0.3.278 

type DNSTracerOption func(*DNSTracer)

DNSTracerOption configures optional DNSTracer behaviour.

func WithDNSRuleForwarding added in v0.3.278 

func WithDNSRuleForwarding(cfg config.DNSRuleForwardingConfig) DNSTracerOption

WithDNSRuleForwarding forwards DNS queries and error responses to the rule manager, as rule-only events, according to cfg. With cfg.Enabled false it is a no-op. See docs/features/dns-query-rule-forwarding.md.

type EventQueueInterface 

type EventQueueInterface interface {
	AddEventDirect(eventType utils.EventType, event utils.K8sEvent, containerID string, processID uint32)
}

EventQueueInterface defines the interface for adding events to the queue

type ExecTracer 

type ExecTracer struct {
	// contains filtered or unexported fields
}

ExecTracer implements TracerInterface for events

func NewExecTracer 

func NewExecTracer(
	kubeManager operators.DataOperator,
	runtime runtime.Runtime,
	ociStore *orasoci.ReadOnlyStore,
	eventCallback containerwatcher.ResultCallback,
	thirdPartyEnricher containerwatcher.TaskBasedEnricher,
) *ExecTracer

NewExecTracer creates a new tracer

func (*ExecTracer) GetEventType 

func (et *ExecTracer) GetEventType() utils.EventType

GetEventType returns the event type this tracer produces

func (*ExecTracer) GetName 

func (et *ExecTracer) GetName() string

GetName returns the unique name of the tracer

func (*ExecTracer) IsEnabled 

func (et *ExecTracer) IsEnabled(cfg config.Config) bool

IsEnabled checks if this tracer should be enabled based on configuration

func (*ExecTracer) Start 

func (et *ExecTracer) Start(ctx context.Context) error

Start initializes and starts the tracer

func (*ExecTracer) Stop 

func (et *ExecTracer) Stop() error

Stop gracefully stops the tracer

type ExitTracer 

type ExitTracer struct {
	// contains filtered or unexported fields
}

ExitTracer implements TracerInterface for events

func NewExitTracer 

func NewExitTracer(
	kubeManager operators.DataOperator,
	runtime runtime.Runtime,
	ociStore *orasoci.ReadOnlyStore,
	eventCallback containerwatcher.ResultCallback,
) *ExitTracer

NewExitTracer creates a new tracer

func (*ExitTracer) GetEventType 

func (et *ExitTracer) GetEventType() utils.EventType

GetEventType returns the event type this tracer produces

func (*ExitTracer) GetName 

func (et *ExitTracer) GetName() string

GetName returns the unique name of the tracer

func (*ExitTracer) IsEnabled 

func (et *ExitTracer) IsEnabled(cfg config.Config) bool

IsEnabled checks if this tracer should be enabled based on configuration

func (*ExitTracer) Start 

func (et *ExitTracer) Start(ctx context.Context) error

Start initializes and starts the tracer

func (*ExitTracer) Stop 

func (et *ExitTracer) Stop() error

Stop gracefully stops the tracer

type ForkTracer 

type ForkTracer struct {
	// contains filtered or unexported fields
}

ForkTracer implements TracerInterface for events

func NewForkTracer 

func NewForkTracer(
	kubeManager operators.DataOperator,
	runtime runtime.Runtime,
	ociStore *orasoci.ReadOnlyStore,
	eventCallback containerwatcher.ResultCallback,
) *ForkTracer

NewForkTracer creates a new tracer

func (*ForkTracer) GetEventType 

func (ft *ForkTracer) GetEventType() utils.EventType

GetEventType returns the event type this tracer produces

func (*ForkTracer) GetName 

func (ft *ForkTracer) GetName() string

GetName returns the unique name of the tracer

func (*ForkTracer) IsEnabled 

func (ft *ForkTracer) IsEnabled(cfg config.Config) bool

IsEnabled checks if this tracer should be enabled based on configuration

func (*ForkTracer) Start 

func (ft *ForkTracer) Start(ctx context.Context) error

Start initializes and starts the tracer

func (*ForkTracer) Stop 

func (ft *ForkTracer) Stop() error

Stop gracefully stops the fork tracer

type HTTPTracer 

type HTTPTracer struct {
	// contains filtered or unexported fields
}

HTTPTracer implements TracerInterface for events

func NewHTTPTracer 

func NewHTTPTracer(
	kubeManager operators.DataOperator,
	runtime runtime.Runtime,
	ociStore *orasoci.ReadOnlyStore,
	eventCallback containerwatcher.ResultCallback,
) *HTTPTracer

NewHTTPTracer creates a new tracer

func (*HTTPTracer) GetEventType 

func (ht *HTTPTracer) GetEventType() utils.EventType

GetEventType returns the event type this tracer produces

func (*HTTPTracer) GetName 

func (ht *HTTPTracer) GetName() string

GetName returns the unique name of the tracer

func (*HTTPTracer) GroupEvents added in v0.3.3 

func (ht *HTTPTracer) GroupEvents(bpfEvent utils.HttpRawEvent) utils.HttpEvent

func (*HTTPTracer) IsEnabled 

func (ht *HTTPTracer) IsEnabled(cfg config.Config) bool

IsEnabled checks if this tracer should be enabled based on configuration

func (*HTTPTracer) Start 

func (ht *HTTPTracer) Start(ctx context.Context) error

Start initializes and starts the tracer

func (*HTTPTracer) Stop 

func (ht *HTTPTracer) Stop() error

Stop gracefully stops the tracer

type HardlinkTracer 

type HardlinkTracer struct {
	// contains filtered or unexported fields
}

HardlinkTracer implements TracerInterface for events

func NewHardlinkTracer 

func NewHardlinkTracer(
	kubeManager operators.DataOperator,
	runtime runtime.Runtime,
	ociStore *orasoci.ReadOnlyStore,
	eventCallback containerwatcher.ResultCallback,
	thirdPartyEnricher containerwatcher.TaskBasedEnricher,
) *HardlinkTracer

NewHardlinkTracer creates a new tracer

func (*HardlinkTracer) GetEventType 

func (ht *HardlinkTracer) GetEventType() utils.EventType

GetEventType returns the event type this tracer produces

func (*HardlinkTracer) GetName 

func (ht *HardlinkTracer) GetName() string

GetName returns the unique name of the tracer

func (*HardlinkTracer) IsEnabled 

func (ht *HardlinkTracer) IsEnabled(cfg config.Config) bool

IsEnabled checks if this tracer should be enabled based on configuration

func (*HardlinkTracer) Start 

func (ht *HardlinkTracer) Start(ctx context.Context) error

Start initializes and starts the tracer

func (*HardlinkTracer) Stop 

func (ht *HardlinkTracer) Stop() error

Stop gracefully stops the tracer

type IoUringTracer 

type IoUringTracer struct {
	// contains filtered or unexported fields
}

IoUringTracer implements TracerInterface for events

func NewIoUringTracer 

func NewIoUringTracer(
	kubeManager operators.DataOperator,
	runtime runtime.Runtime,
	ociStore *orasoci.ReadOnlyStore,
	eventCallback containerwatcher.ResultCallback,
) *IoUringTracer

NewIoUringTracer creates a new tracer

func (*IoUringTracer) GetEventType 

func (it *IoUringTracer) GetEventType() utils.EventType

GetEventType returns the event type this tracer produces

func (*IoUringTracer) GetName 

func (it *IoUringTracer) GetName() string

GetName returns the unique name of the tracer

func (*IoUringTracer) IsEnabled 

func (it *IoUringTracer) IsEnabled(cfg config.Config) bool

IsEnabled checks if this tracer should be enabled based on configuration

func (*IoUringTracer) Start 

func (it *IoUringTracer) Start(ctx context.Context) error

Start initializes and starts the tracer

func (*IoUringTracer) Stop 

func (it *IoUringTracer) Stop() error

Stop gracefully stops the tracer

type KmodTracer added in v0.3.3 

type KmodTracer struct {
	// contains filtered or unexported fields
}

KmodTracer implements TracerInterface for events

func NewKmodTracer added in v0.3.3 

func NewKmodTracer(
	kubeManager operators.DataOperator,
	runtime runtime.Runtime,
	ociStore *orasoci.ReadOnlyStore,
	eventCallback containerwatcher.ResultCallback,
	thirdPartyEnricher containerwatcher.TaskBasedEnricher,
) *KmodTracer

NewKmodTracer creates a new tracer

func (*KmodTracer) GetEventType added in v0.3.3 

func (kt *KmodTracer) GetEventType() utils.EventType

GetEventType returns the event type this tracer produces

func (*KmodTracer) GetName added in v0.3.3 

func (kt *KmodTracer) GetName() string

GetName returns the unique name of the tracer

func (*KmodTracer) IsEnabled added in v0.3.3 

func (kt *KmodTracer) IsEnabled(cfg config.Config) bool

IsEnabled checks if this tracer should be enabled based on configuration

func (*KmodTracer) Start added in v0.3.3 

func (kt *KmodTracer) Start(ctx context.Context) error

Start initializes and starts the tracer

func (*KmodTracer) Stop added in v0.3.3 

func (kt *KmodTracer) Stop() error

Stop gracefully stops the kmod tracer

type NetworkTracer 

type NetworkTracer struct {
	// contains filtered or unexported fields
}

NetworkTracer implements TracerInterface for events

func NewNetworkTracer 

func NewNetworkTracer(
	kubeIPResolver *kubeipresolver.KubeIPResolver,
	kubeManager operators.DataOperator,
	kubeNameResolver *kubenameresolver.KubeNameResolver,
	runtime runtime.Runtime,
	ociStore *orasoci.ReadOnlyStore,
	eventCallback containerwatcher.ResultCallback,
	thirdPartyEnricher containerwatcher.TaskBasedEnricher,
	socketEnricherOp *socketenricher.SocketEnricher,
	kubernetesMode bool,
) *NetworkTracer

NewNetworkTracer creates a new tracer

func (*NetworkTracer) GetEventType 

func (nt *NetworkTracer) GetEventType() utils.EventType

GetEventType returns the event type this tracer produces

func (*NetworkTracer) GetName 

func (nt *NetworkTracer) GetName() string

GetName returns the unique name of the tracer

func (*NetworkTracer) IsEnabled 

func (nt *NetworkTracer) IsEnabled(cfg config.Config) bool

IsEnabled checks if this tracer should be enabled based on configuration

func (*NetworkTracer) Start 

func (nt *NetworkTracer) Start(ctx context.Context) error

Start initializes and starts the tracer

func (*NetworkTracer) Stop 

func (nt *NetworkTracer) Stop() error

Stop gracefully stops the tracer

type OpenTracer 

type OpenTracer struct {
	// contains filtered or unexported fields
}

OpenTracer implements TracerInterface for open events

func NewOpenTracer 

func NewOpenTracer(
	kubeManager operators.DataOperator,
	runtime runtime.Runtime,
	ociStore *orasoci.ReadOnlyStore,
	eventCallback containerwatcher.ResultCallback,
	thirdPartyEnricher containerwatcher.TaskBasedEnricher,
) *OpenTracer

NewOpenTracer creates a new open tracer

func (*OpenTracer) GetEventType 

func (ot *OpenTracer) GetEventType() utils.EventType

GetEventType returns the event type this tracer produces

func (*OpenTracer) GetName 

func (ot *OpenTracer) GetName() string

GetName returns the unique name of the tracer

func (*OpenTracer) IsEnabled 

func (ot *OpenTracer) IsEnabled(cfg config.Config) bool

IsEnabled checks if this tracer should be enabled based on configuration

func (*OpenTracer) Start 

func (ot *OpenTracer) Start(ctx context.Context) error

Start initializes and starts the open tracer

func (*OpenTracer) Stop 

func (ot *OpenTracer) Stop() error

Stop gracefully stops the open tracer

type ProcfsTracer 

type ProcfsTracer struct {
	// contains filtered or unexported fields
}

ProcfsTracer implements TracerInterface for procfs events

func NewProcfsTracer 

func NewProcfsTracer(
	containerCollection *containercollection.ContainerCollection,
	tracerCollection *tracercollection.TracerCollection,
	containerSelector containercollection.ContainerSelector,
	procfsEventCallback func(utils.K8sEvent, string, uint32),
	exitEventCallback containerwatcher.ResultCallback,
	cfg config.Config,
	processTreeManager processtree.ProcessTreeManager,
) *ProcfsTracer

NewProcfsTracer creates a new procfs tracer

func (*ProcfsTracer) GetEventType 

func (pt *ProcfsTracer) GetEventType() utils.EventType

GetEventType returns the event type this tracer produces

func (*ProcfsTracer) GetName 

func (pt *ProcfsTracer) GetName() string

GetName returns the unique name of the tracer

func (*ProcfsTracer) IsEnabled 

func (pt *ProcfsTracer) IsEnabled(cfg config.Config) bool

IsEnabled checks if this tracer should be enabled based on configuration

func (*ProcfsTracer) Start 

func (pt *ProcfsTracer) Start(ctx context.Context) error

Start initializes and starts the procfs tracer

func (*ProcfsTracer) Stop 

func (pt *ProcfsTracer) Stop() error

Stop gracefully stops the procfs tracer

type PtraceTracer 

type PtraceTracer struct {
	// contains filtered or unexported fields
}

PtraceTracer implements TracerInterface for events

func NewPtraceTracer 

func NewPtraceTracer(
	kubeManager operators.DataOperator,
	runtime runtime.Runtime,
	ociStore *orasoci.ReadOnlyStore,
	eventCallback containerwatcher.ResultCallback,
) *PtraceTracer

NewPtraceTracer creates a new tracer

func (*PtraceTracer) GetEventType 

func (pt *PtraceTracer) GetEventType() utils.EventType

GetEventType returns the event type this tracer produces

func (*PtraceTracer) GetName 

func (pt *PtraceTracer) GetName() string

GetName returns the unique name of the tracer

func (*PtraceTracer) IsEnabled 

func (pt *PtraceTracer) IsEnabled(cfg config.Config) bool

IsEnabled checks if this tracer should be enabled based on configuration

func (*PtraceTracer) Start 

func (pt *PtraceTracer) Start(ctx context.Context) error

Start initializes and starts the tracer

func (*PtraceTracer) Stop 

func (pt *PtraceTracer) Stop() error

Stop gracefully stops the tracer

type RCode added in v0.3.3 

type RCode uint16

An RCode is a DNS response status code. 

const (
	RCodeSuccess        RCode = 0 // NoError
	RCodeFormatError    RCode = 1 // FormErr
	RCodeServerFailure  RCode = 2 // ServFail
	RCodeNameError      RCode = 3 // NXDomain
	RCodeNotImplemented RCode = 4 // NotImp
	RCodeRefused        RCode = 5 // Refused
)

Header.RCode values.

func (RCode) String added in v0.3.3 

func (r RCode) String() string

String implements fmt.Stringer.String.

type RandomXTracer 

type RandomXTracer struct {
	// contains filtered or unexported fields
}

RandomXTracer implements TracerInterface for events

func NewRandomXTracer 

func NewRandomXTracer(
	kubeManager operators.DataOperator,
	runtime runtime.Runtime,
	ociStore *orasoci.ReadOnlyStore,
	eventCallback containerwatcher.ResultCallback,
) *RandomXTracer

NewRandomXTracer creates a new tracer

func (*RandomXTracer) GetEventType 

func (rt *RandomXTracer) GetEventType() utils.EventType

GetEventType returns the event type this tracer produces

func (*RandomXTracer) GetName 

func (rt *RandomXTracer) GetName() string

GetName returns the unique name of the tracer

func (*RandomXTracer) IsEnabled 

func (rt *RandomXTracer) IsEnabled(cfg config.Config) bool

IsEnabled checks if this tracer should be enabled based on configuration

func (*RandomXTracer) Start 

func (rt *RandomXTracer) Start(ctx context.Context) error

Start initializes and starts the tracer

func (*RandomXTracer) Stop 

func (rt *RandomXTracer) Stop() error

Stop gracefully stops the tracer

type SSHTracer 

type SSHTracer struct {
	// contains filtered or unexported fields
}

SSHTracer implements TracerInterface for events

func NewSSHTracer 

func NewSSHTracer(
	kubeManager operators.DataOperator,
	runtime runtime.Runtime,
	ociStore *orasoci.ReadOnlyStore,
	eventCallback containerwatcher.ResultCallback,
	socketEnricherOp *socketenricher.SocketEnricher,
) *SSHTracer

NewSSHTracer creates a new tracer

func (*SSHTracer) GetEventType 

func (st *SSHTracer) GetEventType() utils.EventType

GetEventType returns the event type this tracer produces

func (*SSHTracer) GetName 

func (st *SSHTracer) GetName() string

GetName returns the unique name of the tracer

func (*SSHTracer) IsEnabled 

func (st *SSHTracer) IsEnabled(cfg config.Config) bool

IsEnabled checks if this tracer should be enabled based on configuration

func (*SSHTracer) Start 

func (st *SSHTracer) Start(ctx context.Context) error

Start initializes and starts the tracer

func (*SSHTracer) Stop 

func (st *SSHTracer) Stop() error

Stop gracefully stops the tracer

type SymlinkTracer 

type SymlinkTracer struct {
	// contains filtered or unexported fields
}

SymlinkTracer implements TracerInterface for events

func NewSymlinkTracer 

func NewSymlinkTracer(
	kubeManager operators.DataOperator,
	runtime runtime.Runtime,
	ociStore *orasoci.ReadOnlyStore,
	eventCallback containerwatcher.ResultCallback,
	thirdPartyEnricher containerwatcher.TaskBasedEnricher,
) *SymlinkTracer

NewSymlinkTracer creates a new tracer

func (*SymlinkTracer) GetEventType 

func (st *SymlinkTracer) GetEventType() utils.EventType

GetEventType returns the event type this tracer produces

func (*SymlinkTracer) GetName 

func (st *SymlinkTracer) GetName() string

GetName returns the unique name of the tracer

func (*SymlinkTracer) IsEnabled 

func (st *SymlinkTracer) IsEnabled(cfg config.Config) bool

IsEnabled checks if this tracer should be enabled based on configuration

func (*SymlinkTracer) Start 

func (st *SymlinkTracer) Start(ctx context.Context) error

Start initializes and starts the tracer

func (*SymlinkTracer) Stop 

func (st *SymlinkTracer) Stop() error

Stop gracefully stops the symlink tracer

type SyscallTracer 

type SyscallTracer struct {
	// contains filtered or unexported fields
}

SyscallTracer implements TracerInterface for events

func NewSyscallTracer 

func NewSyscallTracer(
	kubeManager operators.DataOperator,
	runtime runtime.Runtime,
	ociStore *orasoci.ReadOnlyStore,
	eventCallback containerwatcher.ResultCallback,
	cfg config.Config,
	reportSyscalls func(containerID string, syscalls []string),
	emitUnresolvedContainerEvents bool,
) *SyscallTracer

NewSyscallTracer creates a new tracer.

emitUnresolvedContainerEvents controls callback's behavior for events whose containerID could not be resolved (host processes, or stale map entries for terminated containers): pass false to skip eventCallback for them too (node-agent's own pre-existing steady-state behavior, and what tracer_factory.go's internal wiring passes); pass true to still run eventCallback for them, which host/ECS-agent-style consumers that care about host-process syscalls need. reportSyscalls is always skipped for an unresolved containerID regardless of this flag, since it identifies its subject by containerID.

func (*SyscallTracer) Flush added in v0.3.293 

func (st *SyscallTracer) Flush(ctx context.Context) error

Flush waits for a fresh fetch and all profile batches preceding it. IG emits arrays serially, including empty fetches. One fetch may already be underway without having entered handleArray, so two new array starts are required.

func (*SyscallTracer) GetEventType 

func (st *SyscallTracer) GetEventType() utils.EventType

GetEventType returns the event type this tracer produces

func (*SyscallTracer) GetName 

func (st *SyscallTracer) GetName() string

GetName returns the unique name of the tracer

func (*SyscallTracer) IsEnabled 

func (st *SyscallTracer) IsEnabled(cfg config.Config) bool

IsEnabled checks if this tracer should be enabled based on configuration

func (*SyscallTracer) Peek 

func (st *SyscallTracer) Peek()

Peek requests an immediate, out-of-band fetch of the advise_seccomp eBPF map. It does not block until the fetch completes or until any resulting events have been processed by this tracer's eventCallback. Flush additionally waits for profile batch delivery.

The gadget instance itself runs with no internal fetch schedule (see Start); every fetch, periodic or not, goes through this one call. Start's own background loop calls it on pollInterval for live event delivery. ContainerProfileManager calls Flush before finalizing a container; Flush uses Peek to drive its fresh-fetch delivery barrier.

func (*SyscallTracer) Start 

func (st *SyscallTracer) Start(ctx context.Context) error

Start initializes and starts the tracer

func (*SyscallTracer) Stop 

func (st *SyscallTracer) Stop() error

Stop gracefully stops the tracer

type TopTracer 

type TopTracer struct {
	// contains filtered or unexported fields
}

TopTracer implements TracerInterface for top events (Prometheus metrics)

func NewTopTracer 

func NewTopTracer(
	containerCollection *containercollection.ContainerCollection,
	tracerCollection *tracercollection.TracerCollection,
	containerSelector containercollection.ContainerSelector,
	eventCallback containerwatcher.ResultCallback,
) *TopTracer

NewTopTracer creates a new top tracer

func (*TopTracer) GetEventType 

func (tt *TopTracer) GetEventType() utils.EventType

GetEventType returns the event type this tracer produces

func (*TopTracer) GetName 

func (tt *TopTracer) GetName() string

GetName returns the unique name of the tracer

func (*TopTracer) IsEnabled 

func (tt *TopTracer) IsEnabled(cfg config.Config) bool

IsEnabled checks if this tracer should be enabled based on configuration

func (*TopTracer) Start 

func (tt *TopTracer) Start(ctx context.Context) error

Start initializes and starts the top tracer

func (*TopTracer) Stop 

func (tt *TopTracer) Stop() error

Stop gracefully stops the top tracer

type TracerFactory 

type TracerFactory struct {
	// contains filtered or unexported fields
}

TracerFactory manages the creation and configuration of all tracers

func NewTracerFactory 

func NewTracerFactory(
	containerCollection *containercollection.ContainerCollection,
	tracerCollection *tracercollection.TracerCollection,
	containerSelector containercollection.ContainerSelector,
	orderedEventQueue EventQueueInterface,
	socketEnricher *socketenricher.SocketEnricher,
	containerProfileManager containerprofilemanager.ContainerProfileManagerClient,
	ruleManager rulemanager.RuleManagerClient,
	thirdPartyTracers mapset.Set[containerwatcher.CustomTracerInitializer],
	thirdPartyEnricher containerwatcher.TaskBasedEnricher,
	cfg config.Config,
	processTreeManager processtree.ProcessTreeManager,
	runtime runtime.Runtime,
) *TracerFactory

NewTracerFactory creates a new tracer factory

func (*TracerFactory) CreateAllTracers 

func (tf *TracerFactory) CreateAllTracers(manager containerwatcher.TracerRegistrer)

CreateAllTracers creates all configured tracers

type Type added in v0.3.3 

type Type uint16

A Type is a type of DNS request and response. 

const (
	// ResourceHeader.Type and Question.Type
	TypeA     Type = 1
	TypeNS    Type = 2
	TypeCNAME Type = 5
	TypeSOA   Type = 6
	TypePTR   Type = 12
	TypeMX    Type = 15
	TypeTXT   Type = 16
	TypeAAAA  Type = 28
	TypeSRV   Type = 33
	TypeOPT   Type = 41

	// Question.Type
	TypeWKS   Type = 11
	TypeHINFO Type = 13
	TypeMINFO Type = 14
	TypeAXFR  Type = 252
	TypeALL   Type = 255
)

func (Type) String added in v0.3.3 

func (t Type) String() string

String implements fmt.Stringer.String.

type UnshareTracer added in v0.3.3 

type UnshareTracer struct {
	// contains filtered or unexported fields
}

UnshareTracer implements TracerInterface for events

func NewUnshareTracer added in v0.3.3 

func NewUnshareTracer(
	kubeManager operators.DataOperator,
	runtime runtime.Runtime,
	ociStore *orasoci.ReadOnlyStore,
	eventCallback containerwatcher.ResultCallback,
	thirdPartyEnricher containerwatcher.TaskBasedEnricher,
) *UnshareTracer

NewUnshareTracer creates a new tracer

func (*UnshareTracer) GetEventType added in v0.3.3 

func (ut *UnshareTracer) GetEventType() utils.EventType

GetEventType returns the event type this tracer produces

func (*UnshareTracer) GetName added in v0.3.3 

func (ut *UnshareTracer) GetName() string

GetName returns the unique name of the tracer

func (*UnshareTracer) IsEnabled added in v0.3.3 

func (ut *UnshareTracer) IsEnabled(cfg config.Config) bool

IsEnabled checks if this tracer should be enabled based on configuration

func (*UnshareTracer) Start added in v0.3.3 

func (ut *UnshareTracer) Start(ctx context.Context) error

Start initializes and starts the tracer

func (*UnshareTracer) Stop added in v0.3.3 

func (ut *UnshareTracer) Stop() error

Stop gracefully stops the unshare tracer

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.