Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Process Tree allows regular SchedFork,Exec,Exit events to be disabled #3479

Closed
rafaeldtinoco opened this issue Sep 18, 2023 · 1 comment
Closed

Comments

@rafaeldtinoco
Copy link
Contributor

Description

Discussion at: #3364 (comment)

// Initialize events state with mandatory events

	t.eventsState[events.SchedProcessExec] = events.EventState{}
	t.eventsState[events.SchedProcessExit] = events.EventState{}
	t.eventsState[events.SchedProcessFork] = events.EventState{}

There is no need for these events to always be enabled now IF capture isn't enabled.

image

Observations:

  1. The SchedProcessExec is needed by processEvent (processSchedProcessExec) for the MntNs bucket and "Capture Exec" feature.
  2. The SchedProcessFork is needed by processEvent (processSchedProcessFork) for converting start_time to Epoch time.
  3. The Exit is only needed because of ebpf maps clean up.

Need to check if refactoring this is something needed/wanted.

@rafaeldtinoco
Copy link
Contributor Author

Being worked at #2586

@yanivagman yanivagman closed this as not planned Won't fix, can't repro, duplicate, stale Sep 18, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants