feat(events): create tracee_info event #4166
Conversation
|
|
||
| ## Arguments | ||
|
|
||
| * `boot_time`:`u64`[U] - the boot time of the system Tracee run in since epoch. |
There was a problem hiding this comment.
| * `boot_time`:`u64`[U] - the boot time of the system Tracee run in since epoch. | |
| * `boot_time`:`u64`[U] - the boot time of the system that Tracee is running on, relative to the Unix epoch. |
|
@yanivagman @rscampos Doesn't this fit the datastore framework much more? Static data which should be accessible over time shouldn't be exposed as a transient event. As this data fits under the |
The first reason for creating this event is to be used by the file source (aka "analyze mode"). Since we only expose events in the output file, I don't think data store would fit for this purpose |
|
I think we should invest in a more robust way to convert datastores in general into sources for the analyze mode in this case, rather than adding directly as a pipeline event (although it could be a solution that datastores emit events). An example for such a design could be that each datastore would implement a "commitlog" interface. So changes can only be done through commits, which the datastore needs to keep track of (if its designed to be used in analyze mode later - maybe some datastore authors in plugins will not have this intention). Then, we could set a flag that dumps the commit-log after tracee's run. Maybe we would have |
Create an event that export Tracee's data upon startup. Co-authored-by: Alon Zivony <alon.zivony@aquasec.com>
b78524b to
5c02ebf
Compare
I agree that we should invest in data stores and to keep its state for later analysis. This will require a careful design and implementation though. So for now, I think we can continue with the approach of having the "tracee_info" event, which can also signal the start of the event stream (thus it can be seen as an event on its own) |
fix: #4174
1. Explain what the PR does
5c02ebf feat(events): create tracee_info event
2. Explain how to test it
3. Other comments
Credits to @AlonZivony, who did the work.