6
6
7
7
#include < libsinsp/sinsp.h>
8
8
9
- #include " storage/process_indicator.pb.h"
10
-
11
9
#include " RateLimit.h"
12
- #include " system-inspector/EventExtractor.h"
13
10
14
11
namespace collector {
15
12
16
- std::string compute_process_key (const ::sensor::ProcessSignal& s) {
13
+ namespace {
14
+ // The template functions in this namespace are meant to be used with
15
+ // sensor::ProcessSignal and storage::ProcessSignal, which are almost
16
+ // the same... Except they are not...
17
+ template <typename S>
18
+ std::string compute_process_key (const S& s) {
17
19
std::stringstream ss;
18
20
ss << s.container_id () << " " << s.name () << " " ;
19
21
if (s.args ().length () <= 256 ) {
@@ -25,19 +27,39 @@ std::string compute_process_key(const ::sensor::ProcessSignal& s) {
25
27
return ss.str ();
26
28
}
27
29
30
+ template <typename S>
31
+ void dtrace_probe (const S& s) {
32
+ const char * name = s.name ().c_str ();
33
+ const uint32_t pid = s.pid ();
34
+ DTRACE_PROBE2 (collector, process_signal_handler, name, pid);
35
+ }
36
+ } // namespace
37
+
28
38
SignalHandler::Result ProcessSignalHandler::HandleSignal (sinsp_evt* evt) {
29
- const auto * signal_msg = formatter_.ToProtoMessage (evt);
39
+ if (client_->UseSensorClient ()) {
40
+ return HandleSensorSignal (evt);
41
+ }
42
+ return HandleProcessSignal (evt);
43
+ }
44
+
45
+ SignalHandler::Result ProcessSignalHandler::HandleExistingProcess (sinsp_threadinfo* tinfo) {
46
+ if (client_->UseSensorClient ()) {
47
+ return HandleExistingProcessSensor (tinfo);
48
+ }
49
+ return HandleExistingProcessSignal (tinfo);
50
+ }
51
+
52
+ SignalHandler::Result ProcessSignalHandler::HandleProcessSignal (sinsp_evt* evt) {
53
+ const auto * signal_msg = signal_formatter_.ToProtoMessage (evt);
30
54
31
55
if (signal_msg == nullptr ) {
32
56
++(stats_->nProcessResolutionFailuresByEvt );
33
57
return IGNORED;
34
58
}
35
59
36
- const char * name = signal_msg->process_signal ().name ().c_str ();
37
- const uint32_t pid = signal_msg->process_signal ().pid ();
38
- DTRACE_PROBE2 (collector, process_signal_handler, name, pid);
60
+ dtrace_probe (signal_msg->signal ().process_signal ());
39
61
40
- if (!rate_limiter_.Allow (compute_process_key (signal_msg->process_signal ()))) {
62
+ if (!rate_limiter_.Allow (compute_process_key (signal_msg->signal (). process_signal ()))) {
41
63
++(stats_->nProcessRateLimitCount );
42
64
return IGNORED;
43
65
}
@@ -52,13 +74,38 @@ SignalHandler::Result ProcessSignalHandler::HandleSignal(sinsp_evt* evt) {
52
74
return result;
53
75
}
54
76
55
- SignalHandler::Result ProcessSignalHandler::HandleExistingProcess (sinsp_threadinfo* tinfo) {
56
- const auto * signal_msg = formatter_ .ToProtoMessage (tinfo);
77
+ SignalHandler::Result ProcessSignalHandler::HandleExistingProcessSignal (sinsp_threadinfo* tinfo) {
78
+ const auto * signal_msg = signal_formatter_ .ToProtoMessage (tinfo);
57
79
if (signal_msg == nullptr ) {
58
80
++(stats_->nProcessResolutionFailuresByTinfo );
59
81
return IGNORED;
60
82
}
61
83
84
+ if (!rate_limiter_.Allow (compute_process_key (signal_msg->signal ().process_signal ()))) {
85
+ ++(stats_->nProcessRateLimitCount );
86
+ return IGNORED;
87
+ }
88
+
89
+ auto result = client_->SendMsg (*signal_msg);
90
+ if (result == SignalHandler::PROCESSED) {
91
+ ++(stats_->nProcessSent );
92
+ } else if (result == SignalHandler::ERROR) {
93
+ ++(stats_->nProcessSendFailures );
94
+ }
95
+
96
+ return result;
97
+ }
98
+
99
+ SignalHandler::Result ProcessSignalHandler::HandleSensorSignal (sinsp_evt* evt) {
100
+ const auto * signal_msg = sensor_formatter_.ToProtoMessage (evt);
101
+
102
+ if (signal_msg == nullptr ) {
103
+ ++(stats_->nProcessResolutionFailuresByEvt );
104
+ return IGNORED;
105
+ }
106
+
107
+ dtrace_probe (signal_msg->process_signal ());
108
+
62
109
if (!rate_limiter_.Allow (compute_process_key (signal_msg->process_signal ()))) {
63
110
++(stats_->nProcessRateLimitCount );
64
111
return IGNORED;
@@ -74,6 +121,27 @@ SignalHandler::Result ProcessSignalHandler::HandleExistingProcess(sinsp_threadin
74
121
return result;
75
122
}
76
123
124
+ SignalHandler::Result ProcessSignalHandler::HandleExistingProcessSensor (sinsp_threadinfo* tinfo) {
125
+ const auto * signal_msg = sensor_formatter_.ToProtoMessage (tinfo);
126
+ if (signal_msg == nullptr ) {
127
+ ++(stats_->nProcessResolutionFailuresByTinfo );
128
+ return IGNORED;
129
+ }
130
+
131
+ if (!rate_limiter_.Allow (compute_process_key (signal_msg->process_signal ()))) {
132
+ ++(stats_->nProcessRateLimitCount );
133
+ return IGNORED;
134
+ }
135
+
136
+ auto result = client_->SendMsg (*signal_msg);
137
+ if (result == SignalHandler::PROCESSED) {
138
+ ++(stats_->nProcessSent );
139
+ } else if (result == SignalHandler::ERROR) {
140
+ ++(stats_->nProcessSendFailures );
141
+ }
142
+
143
+ return result;
144
+ }
77
145
std::vector<std::string> ProcessSignalHandler::GetRelevantEvents () {
78
146
return {" execve<" };
79
147
}
0 commit comments