trace.Event interface refactor #4742
Conversation
a558ca2 to
0bb5749
Compare
There was a problem hiding this comment.
All seems neat. 👍🏻 This will bring us the possibility to include metrics and other stuff in the event object as well.
@NDStrahilevitz please call me again when possible.
| @@ -14,42 +14,39 @@ import ( | |||
| ) | |||
|
<
8000
span class="blob-code-inner blob-code-marker-context"> |
|||
| // Event is a single result of an ebpf event process. It is used as a payload later delivered to tracee-rules. | |||
There was a problem hiding this comment.
It's a good opportunity to renew this description.
There was a problem hiding this comment.
Hmmmm, have any good ideas? @yanivagman Do you have something somewhere from the "everything is an event" docs?
fb9c0dc to
e487eff
Compare
The trace.Event is no longer a struct, but rather an interface that tracee will implement internally. This change will facillitate easier refactors in the event structure in the future and provides an easy opportunity for later backwards compatibility. Signature authors in particular should take note of this change and realign to its usage.
This change moves the event struct (largely intact from the types package) into a new pipeline package. This is a step towards decoupling the event structure from the event implementation internal to tracee. Accordingly, all the pipeline and event handling logic now uses the struct defined in the pipeline package. The interface is left to signatures.
e487eff to
3ba434d
Compare
|
@NDStrahilevitz, while reviewing @trvll's high-CPU profiles, we noticed that the decode stage is a significant contributor. Currently, |
I think this PR is just what may be able to facilitate this kind of optimization. Again, I tend on the side of doing this in its own PR, but it will be a good testing ground for the stability of the interface change. Just note that the context has various constant size byte arrays, whereas we want to present strings. So again, this relates to the previous discussion thread on aligning the field sizes to the context field sizes. |
1. Explain what the PR does
"Replace me with
make check-proutput"2. Explain how to test it
3. Other comments