Documentation
¶
Overview ¶
Package eventprocessor coordinates event processing and routes eBPF events to specialized handlers.
Architecture:
┌─────────────────────────────────────────┐
│ eBPF Ring Buffer Events │
└─────────────────┬───────────────────────┘
│
▼
┌─────────────────────────────────────────┐
│ eventprocessor │ ← Event routing
│ - Routes by event type │
│ - Delegates to handlers │
└─────────┬───────────────────────────────┘
│
├──→ EnvChunkEvent ──→ envreassembler
│ - Buffers chunks
│ - Parses null-terminated strings
│ - Produces Args + Env
│
├──→ EnvVarEvent ────→ envreassembler
│ - Collects streaming variables
│ - Produces Args + Env
│
├──→ Reassembled ───→ procmeta.Manager
│ data - Stores metadata per PID
│ - Tracks lifecycle
│
├──→ EXEC/EXIT ─────→ ProcessEventHandler
│ - Creates/finalizes spans
│ - Uses attributes evaluator
│ - Uses timesync converter
│
└──→ TCP events ────→ TCPEventHandler
- Creates/finalizes TCP spans
The processor delegates to ProcessEventHandler and TCPEventHandler interfaces, typically implemented by the output formatter.
Index ¶
- type EventHandler
- type ProcessEventHandler
- type Processor
- func (p *Processor) HandleAncestorTrace(_ *bpf.AncestorTraceEvent) error
- func (p *Processor) HandleCloneSyscall(_ *bpf.CloneSyscallEvent) error
- func (p *Processor) HandleEnvChunk(chunk *bpf.EnvChunkEvent) error
- func (p *Processor) HandleEnvVar(envVar *bpf.EnvVarEvent) error
- func (p *Processor) HandleEvent(event *bpf.Event) error
- type TCPEventHandler
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type EventHandler ¶
type EventHandler interface {
HandleEvent(event *bpf.Event) error
HandleEnvChunk(chunk *bpf.EnvChunkEvent) error
HandleEnvVar(envVar *bpf.EnvVarEvent) error
HandleAncestorTrace(trace *bpf.AncestorTraceEvent) error
HandleCloneSyscall(ev *bpf.CloneSyscallEvent) error
}
EventHandler is the interface for handling BPF events from the ring buffer.
type ProcessEventHandler ¶
type ProcessEventHandler interface {
HandleProcessExec(pid, ppid, uid uint32, timestamp uint64, metadata *procmeta.ProcessMetadata) error
HandleProcessExit(pid, ppid, uid uint32, exitCode uint32, timestamp uint64, comm []byte) error
}
ProcessEventHandler handles processed process events.
type Processor ¶
type Processor struct {
// contains filtered or unexported fields
}
Processor coordinates event processing. It routes events to specialized handlers and manages data reassembly.
func NewProcessor ¶
func NewProcessor( metadataManager *procmeta.Manager, resolver *reversedns.Resolver, processHandler ProcessEventHandler, tcpHandler TCPEventHandler, ) *Processor
NewProcessor creates a new event processor.
func (*Processor) HandleAncestorTrace ¶ added in v0.8.5
func (p *Processor) HandleAncestorTrace(_ *bpf.AncestorTraceEvent) error
HandleAncestorTrace is a no-op in direct mode — this handler is ambient-only diagnostic. Kept on the type to satisfy the EventHandler interface.
func (*Processor) HandleCloneSyscall ¶ added in v0.8.5
func (p *Processor) HandleCloneSyscall(_ *bpf.CloneSyscallEvent) error
HandleCloneSyscall is a no-op in direct mode — the clone tracepoints are ambient-diagnostic-only.
func (*Processor) HandleEnvChunk ¶
func (p *Processor) HandleEnvChunk(chunk *bpf.EnvChunkEvent) error
HandleEnvChunk processes environment variable chunks from execve events.
func (*Processor) HandleEnvVar ¶
func (p *Processor) HandleEnvVar(envVar *bpf.EnvVarEvent) error
HandleEnvVar processes individual environment variable events from streaming execve.
type TCPEventHandler ¶
type TCPEventHandler interface {
HandleTCPConnect(pid uint32, skaddr uint64, saddr, daddr []byte, sport, dport, family uint16, timestamp uint64) error
HandleTCPClose(pid uint32, skaddr uint64, saddr, daddr []byte, sport, dport, family uint16, timestamp uint64) error
}
TCPEventHandler handles processed TCP events.
Source Files