Documentation
¶
Overview ¶
Package output provides formatters for converting processed events into output formats.
OTELFormatter is a pure formatting layer that:
- Receives pre-processed event data
- Creates OpenTelemetry spans
- Sets span attributes from prepared data
It does NOT:
- Handle raw eBPF events
- Reassemble data chunks
- Evaluate expressions
- Manage process metadata lifecycle
All data processing is delegated to specialized packages:
- timesync: Monotonic timestamp conversion
- attributes: Expression evaluation
- procmeta: Metadata storage and retrieval
The formatter receives fully-processed data through the ProcessEventHandler and TCPEventHandler interfaces.
Index ¶
- type OTELFormatter
- func (f *OTELFormatter) EndSession(endTime time.Time)
- func (f *OTELFormatter) HandleProcessExec(pid, ppid, _ uint32, timestamp uint64, _ *procmeta.ProcessMetadata) error
- func (f *OTELFormatter) HandleProcessExit(pid, ppid, uid uint32, _ uint32, timestamp uint64, comm []byte) error
- func (f *OTELFormatter) HandleTCPClose(pid uint32, skaddr uint64, saddr, daddr []byte, sport, dport, family uint16, ...) error
- func (f *OTELFormatter) HandleTCPConnect(pid uint32, skaddr uint64, _, _ []byte, _, _, _ uint16, timestamp uint64) error
- func (f *OTELFormatter) ResolvedTraceExprValue() string
- func (f *OTELFormatter) ResolvedTraceID() string
- func (f *OTELFormatter) ResolvedTraceSource() string
- func (f *OTELFormatter) StartSession(ctx context.Context, metadata *procmeta.ProcessMetadata, startTime time.Time)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type OTELFormatter ¶
type OTELFormatter struct {
// contains filtered or unexported fields
}
OTELFormatter formats processed data as OpenTelemetry spans. This is a pure formatting layer - it receives pre-processed data and creates spans.
A single invocation of process-tracer produces one "process.tree" root span (created by StartSession, ended by EndSession) under which all process.exec spans hang. If a process.exec's ppid span isn't tracked, the span falls back to the process.tree root — orphans are never allowed to start a new trace.
func NewOTELFormatter ¶
func NewOTELFormatter( tracer trace.Tracer, converter *timesync.Converter, resolver *reversedns.Resolver, metadataManager *procmeta.Manager, customAttrs []config.CustomAttribute, skipEmptyValues bool, traceIDExpr string, parentIDExpr string, addDebugAttributes bool, ) (*OTELFormatter, error)
NewOTELFormatter creates a new OTEL formatter.
func (*OTELFormatter) EndSession ¶ added in v0.6.0
func (f *OTELFormatter) EndSession(endTime time.Time)
EndSession finalizes the "process.tree" root span. Safe to call more than once.
func (*OTELFormatter) HandleProcessExec ¶
func (f *OTELFormatter) HandleProcessExec(pid, ppid, _ uint32, timestamp uint64, _ *procmeta.ProcessMetadata) error
HandleProcessExec creates a new process span.
func (*OTELFormatter) HandleProcessExit ¶
func (f *OTELFormatter) HandleProcessExit(pid, ppid, uid uint32, _ uint32, timestamp uint64, comm []byte) error
HandleProcessExit finalizes a process span.
func (*OTELFormatter) HandleTCPClose ¶
func (f *OTELFormatter) HandleTCPClose(pid uint32, skaddr uint64, saddr, daddr []byte, sport, dport, family uint16, timestamp uint64) error
HandleTCPClose finalizes a TCP connection span.
func (*OTELFormatter) HandleTCPConnect ¶
func (f *OTELFormatter) HandleTCPConnect(pid uint32, skaddr uint64, _, _ []byte, _, _, _ uint16, timestamp uint64) error
HandleTCPConnect creates a new TCP connection span.
func (*OTELFormatter) ResolvedTraceExprValue ¶ added in v0.8.1
func (f *OTELFormatter) ResolvedTraceExprValue() string
ResolvedTraceExprValue returns the raw pre-hash value of the trace_id expression (or literal) at session creation. Empty when unconfigured. Diagnostic use only.
func (*OTELFormatter) ResolvedTraceID ¶ added in v0.8.1
func (f *OTELFormatter) ResolvedTraceID() string
ResolvedTraceID returns the 32-char hex trace ID this formatter applied to the session root, or "" if the trace ID was auto-generated (unconfigured). Populated by StartSession; diagnostic use only.
func (*OTELFormatter) ResolvedTraceSource ¶ added in v0.8.1
func (f *OTELFormatter) ResolvedTraceSource() string
ResolvedTraceSource returns attributes.SourceLiteral / SourceExpr / SourceUnconfigured for the trace_id at session creation. Diagnostic only.
func (*OTELFormatter) StartSession ¶ added in v0.6.0
func (f *OTELFormatter) StartSession(ctx context.Context, metadata *procmeta.ProcessMetadata, startTime time.Time)
StartSession creates the synthetic "process.tree" root span for this invocation. Must be called before any Handle* methods so that children can be parented under it.
metadata describes the invocation context used to resolve trace_id/parent_id expressions (typically the matched process in daemon mode, or a synthetic representation of the traced command in trace mode). May be nil, in which case trace_id/parent_id expressions are evaluated against empty state.
Source Files