pkg/encoder: add custom printers for open and openat

Rename the output for fd_install to fd_install instead of open and change the default emoji for unrecognized symbols since previous emoji was shifting alignment. Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
cilium · Apr 11, 2023 · ab91a47 · ab91a47
1 parent 30c81f2
commit ab91a47
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 3 deletions.
diff --git a/pkg/encoder/encoder.go b/pkg/encoder/encoder.go
@@ -190,7 +190,21 @@ func (p *CompactEncoder) EventToString(response *tetragon.GetEventsResponse) (st
 				file = p.Colorer.Cyan.Sprint(kprobe.Args[1].GetFileArg().Path)
 			}
 			return CapTrailorPrinter(fmt.Sprintf("%s %s %s", event, processInfo, file), caps), nil
-		case "__x64_sys_close":
+		case "sys_openat":
+			event := p.Colorer.Blue.Sprintf("📬️ %-7s", "openat")
+			file := ""
+			if len(kprobe.Args) > 1 && kprobe.Args[1] != nil {
+				file = p.Colorer.Cyan.Sprint(kprobe.Args[1].GetStringArg())
+			}
+			return CapTrailorPrinter(fmt.Sprintf("%s %s %s", event, processInfo, file), caps), nil
+		case "sys_open":
+			event := p.Colorer.Blue.Sprintf("📬️ %-7s", "open")
+			file := ""
+			if len(kprobe.Args) > 1 && kprobe.Args[1] != nil {
+				file = p.Colorer.Cyan.Sprint(kprobe.Args[1].GetStringArg())
+			}
+			return CapTrailorPrinter(fmt.Sprintf("%s %s %s", event, processInfo, file), caps), nil
+		case "sys_close":
 			event := p.Colorer.Blue.Sprintf("📪 %-7s", "close")
 			file := ""
 			if len(kprobe.Args) > 0 && kprobe.Args[0] != nil && kprobe.Args[0].GetFileArg() != nil {
@@ -294,7 +308,7 @@ func (p *CompactEncoder) EventToString(response *tetragon.GetEventsResponse) (st
 			}
 			return CapTrailorPrinter(fmt.Sprintf("%s %s %s", event, processInfo, attr), caps), nil
 		default:
-			event := p.Colorer.Blue.Sprintf("⁉️ %-7s", "syscall")
+			event := p.Colorer.Blue.Sprintf("❓ %-7s", "syscall")
 			return CapTrailorPrinter(fmt.Sprintf("%s %s %s", event, processInfo, kprobe.FunctionName), caps), nil
 		}
 	case *tetragon.GetEventsResponse_ProcessTracepoint:

diff --git a/pkg/encoder/encoder_test.go b/pkg/encoder/encoder_test.go
@@ -146,7 +146,8 @@ func TestCompactEncoder_KprobeEventToString(t *testing.T) {
 		},
 	})
 	assert.NoError(t, err)
-	assert.Equal(t, "⁉️ syscall kube-system/tetragon /usr/bin/curl unhandled_function", result)
+	assert.Equal(t, "❓ syscall kube-system/tetragon /usr/bin/curl unhandled_function", result)
+
 }
 
 func TestCompactEncoder_KprobeOpenEventToString(t *testing.T) {