[Question] How to collect process_connect 、process_close and process_listen events

[Taction]

I've seen the four golden signlas here: https://github.com/cilium/tetragon/tree/main/docs/security-observability-with-ebpf/03_chapter/00_four_golden_signals . But there are only tutorials about how to collect "PROCESS_EXEC", "PROCESS_EXIT", "PROCESS_KPROBE" events.
I want to know how to collect process_connect 、process_close and process_listen events, any help would be appreciated!

Here is my tetragon configmap:

kubectl get cm -n kube-system tetragon-config -o yaml
apiVersion: v1
data:
  enable-k8s-api: "true"
  enable-process-cred: "false"
  enable-process-ns: "false"
  export-allowlist: '{"event_set":["PROCESS_EXEC", "PROCESS_EXIT", "PROCESS_KPROBE",
    "PROCESS_TRACEPOINT"]}'
  export-denylist: |-
    {"health_check":true}
    {"namespace":["", "cilium", "kube-system"]}
  export-file-compress: "false"
  export-file-max-backups: "5"
  export-file-max-size-mb: "10"
  export-filename: /var/run/cilium/tetragon/tetragon.log
  export-rate-limit: "-1"
  metrics-server: :2112
  process-cache-size: "65536"
  procfs: /procRoot
kind: ConfigMap
metadata:
  annotations:
    meta.helm.sh/release-name: tetragon
    meta.helm.sh/release-namespace: kube-system
  creationTimestamp: "2022-06-15T01:45:41Z"
  labels:
    app.kubernetes.io/instance: tetragon
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: tetragon
    helm.sh/chart: tetragon-0.8.0
  name: tetragon-config
  namespace: kube-system
  resourceVersion: "20294151"
  uid: 1749b71a-e54f-4c4f-9eb8-881c73bf4841

[Furisto]

I do not think this is implemented in the open source version of tetragon. Here is how I have done it:

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: "connect"
spec:
  kprobes:
  - call: "tcp_connect"
    syscall: false
    args:
     - index: 0
       type: "sock"
  - call: "tcp_close"
    syscall: false
    args:
     - index: 0
       type: "sock"

[Taction]

@Furisto Thank you for the explanation and example!

[willfindlay]

Just dropping in to confirm that those are not in the OSS version. The workaround suggested by @Furisto is a good way to approximate these with what we have in OSS.