initial and incomplete support for filtering in the get_thread_table lua api call

Author: ldegio

userspace/libsinsp/chisel.cpp

@@ -750,7 +750,7 @@ void sinsp_chisel::set_args(string args)
 			throw sinsp_exception("corrupted parameters for chisel " + m_filename);
 		}
 
-		m_argvals.push_back(args.substr(token_begin, j));
+		m_argvals.push_back(args.substr(token_begin, j - quote_correction - token_begin));
 	}
 
 	//

userspace/libsinsp/chisel.h

@@ -114,6 +114,10 @@ class SINSP_PUBLIC sinsp_chisel
 	void on_capture_start();
 	void on_capture_end();
 	bool get_nextrun_args(OUT string* args);
+	chisel_desc* get_lua_script_info()
+	{
+		return &m_lua_script_info;
+	}
 
 private:
 	bool openfile(string filename, OUT ifstream* is);

userspace/libsinsp/chisel_api.cpp

@@ -577,7 +577,13 @@ int lua_cbacks::get_thread_table(lua_State *ls)
 	threadinfo_map_iterator_t it;
 	unordered_map<int64_t, sinsp_fdinfo_t>::iterator fdit;
 	uint32_t j;
+	sinsp_filter* filter = NULL;
+	sinsp_evt tevt;
+	scap_evt tscapevt;
 
+	//
+	// Get the chisel state
+	//
 	lua_getglobal(ls, "sichisel");
 
 	sinsp_chisel* ch = (sinsp_chisel*)lua_touserdata(ls, -1);
@@ -587,6 +593,37 @@ int lua_cbacks::get_thread_table(lua_State *ls)
 	ASSERT(ch->m_lua_cinfo);
 	ASSERT(ch->m_inspector);
 
+	//
+	// If the caller specified a filter, compile it
+	//
+	if(lua_isstring(ls, 1)) 
+	{
+		string filterstr = lua_tostring(ls, 1);
+		lua_pop(ls, 1);
+
+		try
+		{
+			filter = new sinsp_filter(ch->m_inspector, filterstr);
+		}
+		catch(sinsp_exception& e)
+		{
+			string err = "invalid filter argument for get_thread_table in chisel " + ch->m_filename + ": " + e.what();
+			fprintf(stderr, "%s\n", err.c_str());
+			throw sinsp_exception("chisel error");
+		}
+
+		tscapevt.ts = 0;
+		tscapevt.type = PPME_SYSCALL_READ_X;
+		tscapevt.len = 0;
+
+		tevt.m_inspector = ch->m_inspector;
+		tevt.m_info = &(g_infotables.m_event_info[PPME_SYSCALL_READ_X]);
+		tevt.m_pevt = NULL;
+		tevt.m_cpuid = 0;
+		tevt.m_evtnum = 0;
+		tevt.m_pevt = &tscapevt;
+	}
+
 	threadinfo_map_t* threadtable  = ch->m_inspector->m_thread_manager->get_threads();
 
 	ASSERT(threadtable != NULL);
@@ -595,6 +632,39 @@ int lua_cbacks::get_thread_table(lua_State *ls)
 
 	for(it = threadtable->begin(); it != threadtable->end(); ++it)
 	{
+if(it->second.m_comm == "colord")
+{
+	int a = 0;
+}
+		//
+		// Check if there's at least an fd that matches the filter.
+		// If not, skip this thread
+		//
+		sinsp_fdtable* fdtable = it->second.get_fd_table();
+
+		if(filter != NULL)
+		{
+			bool match = false;
+
+			for(fdit = fdtable->m_table.begin(); fdit != fdtable->m_table.end(); ++fdit)
+			{
+				tevt.m_tinfo = &(it->second);
+				tevt.m_fdinfo = &(fdit->second);
+				tscapevt.tid = it->first;
+
+				if(filter->run(&tevt))
+				{
+					match = true;
+					break;
+				}
+			}
+
+			if(!match)
+			{
+				continue;
+			}
+		}
+
 		//
 		// Set the thread properties
 		//
@@ -702,10 +772,21 @@ int lua_cbacks::get_thread_table(lua_State *ls)
 		// Create and populate the FD table
 		//
 		lua_pushstring(ls, "fdtable");
-		sinsp_fdtable* fdtable = it->second.get_fd_table();
 		lua_newtable(ls);
 		for(fdit = fdtable->m_table.begin(); fdit != fdtable->m_table.end(); ++fdit)
 		{
+			tevt.m_tinfo = &(it->second);
+			tevt.m_fdinfo = &(fdit->second);
+			tscapevt.tid = it->first;
+
+			if(filter != NULL)
+			{
+				if(filter->run(&tevt) == false)
+				{
+					continue;
+				}
+			}
+
 			lua_newtable(ls);
 			lua_pushliteral(ls, "name");
 			lua_pushstring(ls, fdit->second.tostring_clean().c_str());
@@ -724,6 +805,11 @@ int lua_cbacks::get_thread_table(lua_State *ls)
 		lua_rawseti(ls,-2, (uint32_t)it->first);
 	}
 
+	if(filter)
+	{
+		delete filter;
+	}
+
 	return 1;
 }
 

userspace/libsinsp/event.h

@@ -312,6 +312,7 @@ VISIBILITY_PRIVATE
 	friend class sinsp_dumper;
 	friend class sinsp_analyzer_fd_listener;
 	friend class sinsp_analyzer_parsers;
+	friend class lua_cbacks;
 };
 
 /*@}*/

userspace/sysdig/chisels/lsof.lua

@@ -16,27 +16,35 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 --]]
 
 -- Chisel description
-description = "This chisel prints the open file descriptors for every process in the system, with an output that is very similar to the one of lsof";
+description = "This chisel prints the open file descriptirs for every process in the system, with an output that is very similar to the one of lsof";
 short_description = "List the open file descriptors.";
 category = "System State";
 
 -- Argument list
-args = {}
+args = 
+{
+	{
+		name = "filter",
+		description = "a sysdig-like filter expression that allows restricting the FD list. E.g. 'proc.name=foo and fd.name contains /etc'.", 
+		argtype = "filter",
+		optional = true
+	}
+}
 
 -- Imports and globals
 require "common"
 local dctable = {}
 local capturing = false
+local filter = nil
 
 -- Argument notification callback
 function on_set_arg(name, val)
-    if name == "dump_file_name" then
-		do_dump = true
-        dump_file_name = val
-        return true
-    end
+	if name == "filter" then
+		filter = val
+		return true
+	end
 
-    return false
+	return false
 end
 
 -- Initialization callback
@@ -59,7 +67,7 @@ function on_capture_end()
 		return
 	end
 
-	local ttable = sysdig.get_thread_table()
+	local ttable = sysdig.get_thread_table(filter)
 
 	print(extend_string("COMMAND", 20) ..
 		extend_string("PID", 8) ..

userspace/sysdig/chisels/spy_port.lua

@@ -28,12 +28,12 @@ args =
 		description = "the remote host IP port number", 
 		argtype = "int"
 	},
-        {
-               name = "disable_color",
-               description = "Set to 'disable_colors' if you want to disable color output",
-               argtype = "string",
-               optional = true
-        },
+	{
+		   name = "disable_color",
+		   description = "Set to 'disable_colors' if you want to disable color output",
+		   argtype = "string",
+		   optional = true
+	},
 }
 
 require "common"

userspace/sysdig/sysdig.cpp

@@ -346,14 +346,21 @@ static void parse_chisel_args(sinsp_chisel* ch, sinsp* inspector, int optind, in
 						}
 					}
 
-					try
+					if(nargs == 1 && ch->get_lua_script_info()->m_args[0].m_type == "filter")
 					{
-						sinsp_filter df(inspector, testflt);
+						ch->set_args(args);
 					}
-					catch(...)
+					else
 					{
-						ch->set_args(args);
-						(*n_filterargs)++;
+						try
+						{
+							sinsp_filter df(inspector, testflt);
+						}
+						catch(...)
+						{
+							ch->set_args(args);
+							(*n_filterargs)++;
+						}
 					}
 				}
 			}