Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: send enter events also with scap files not only in live captures #2202

Merged
merged 5 commits into from
Dec 17, 2024

Conversation

Andreagit97
Copy link
Member

What type of PR is this?

/kind bug

Any specific area of the project related to this PR?

/area libscap-engine-savefile

/area libscap

/area libsinsp

/area tests

Does this PR require a change in the driver versions?

No

What this PR does / why we need it:

This PR provides 2 main fixes:

  • today sinsp skip the event reset phase if the enter event is dropped. Sometimes this is dangerous because we are not able to associate the fd to the event. See the connect or the close case.
  • before this PR enter events for pread and read were skipped by the scap file converter but this is probably not what we want, with scap-file we want to emulate the same behavior of the live capture, so populate the state only with exit events but always send the enter ones... This PR reintroduce the enter events for pread/read changing the behavior of the scap-file converter

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

Copy link

github-actions bot commented Dec 16, 2024

Perf diff from master - unit tests

     9.46%     +1.27%  [.] sinsp::next
     4.30%     -0.94%  [.] sinsp_evt::load_params
     6.25%     -0.93%  [.] next_event_from_file
     0.88%     -0.51%  [.] 0x00000000000ec3a0
     2.81%     -0.44%  [.] is_conversion_needed
     7.04%     +0.43%  [.] sinsp_evt::get_type
     1.15%     +0.43%  [.] sinsp::fetch_next_event
     1.01%     -0.36%  [.] std::vector<sinsp_evt_param, std::allocator<sinsp_evt_param> >::emplace_back<sinsp_evt*, unsigned int&, char const*, unsigned long&>
     0.52%     +0.34%  [.] sinsp_fdtable::find
     1.01%     +0.34%  [.] std::_Hashtable<long, std::pair<long const, std::shared_ptr<sinsp_threadinfo> >, std::allocator<std::pair<long const, std::shared_ptr<sinsp_threadinfo> > >, std::__detail::_Select1st, std::equal_to<long>, std::hash<long>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true> >::find

Heap diff from master - unit tests

peak heap memory consumption: -3.10K
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Heap diff from master - scap file

peak heap memory consumption: 0B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Benchmarks diff from master

Comparing gbench_data.json to /root/actions-runner/_work/libs/libs/build/gbench_data.json
Benchmark                                                         Time             CPU      Time Old      Time New       CPU Old       CPU New
----------------------------------------------------------------------------------------------------------------------------------------------
BM_sinsp_split_mean                                            +0.0342         +0.0342           147           152           147           152
BM_sinsp_split_median                                          +0.0328         +0.0328           146           151           146           151
BM_sinsp_split_stddev                                          +0.1117         +0.1110             1             1             1             1
BM_sinsp_split_cv                                              +0.0749         +0.0743             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_mean                  +0.0239         +0.0239            61            63            61            63
BM_sinsp_concatenate_paths_relative_path_median                +0.0230         +0.0231            61            63            61            63
BM_sinsp_concatenate_paths_relative_path_stddev                -0.3670         -0.3659             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_cv                    -0.3818         -0.3807             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_mean                     -0.0359         -0.0359            25            24            25            24
BM_sinsp_concatenate_paths_empty_path_median                   -0.0303         -0.0303            25            24            25            24
BM_sinsp_concatenate_paths_empty_path_stddev                   -0.8702         -0.8704             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_cv                       -0.8653         -0.8656             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_mean                  +0.0412         +0.0412            62            65            62            65
BM_sinsp_concatenate_paths_absolute_path_median                +0.0535         +0.0535            61            64            61            64
BM_sinsp_concatenate_paths_absolute_path_stddev                -0.1220         -0.1223             2             1             2             1
BM_sinsp_concatenate_paths_absolute_path_cv                    -0.1568         -0.1570             0             0             0             0
BM_sinsp_split_container_image_mean                            +0.0259         +0.0259           382           392           382           392
BM_sinsp_split_container_image_median                          +0.0244         +0.0244           383           392           383           392
BM_sinsp_split_container_image_stddev                          +0.1189         +0.1199             3             4             3             4
BM_sinsp_split_container_image_cv                              +0.0906         +0.0916             0             0             0             0

Copy link

codecov bot commented Dec 16, 2024

Codecov Report

Attention: Patch coverage is 95.88235% with 7 lines in your changes missing coverage. Please review.

Project coverage is 75.38%. Comparing base (0bdee92) to head (d6658b7).
Report is 6 commits behind head on master.

Files with missing lines Patch % Lines
userspace/libsinsp/test/sinsp_with_test_input.cpp 94.00% 3 Missing ⚠️
userspace/libsinsp/test/parsers/parse_pread.cpp 94.28% 2 Missing ⚠️
userspace/libsinsp/test/parsers/parse_read.cpp 93.93% 2 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #2202      +/-   ##
==========================================
+ Coverage   75.19%   75.38%   +0.19%     
==========================================
  Files         261      264       +3     
  Lines       33880    34014     +134     
  Branches     5803     5805       +2     
==========================================
+ Hits        25476    25642     +166     
+ Misses       8404     8372      -32     
Flag Coverage Δ
libsinsp 75.38% <95.88%> (+0.19%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@Andreagit97 Andreagit97 force-pushed the change_scap_file_management branch from ed1b530 to 68f6a46 Compare December 16, 2024 10:35
@Andreagit97
Copy link
Member Author

Andreagit97 commented Dec 16, 2024

Rebased on master to fix the CI

since write has the EF_USES_FLAG, we call `set_fd_info` in
`sinsp_parser::reset`

Signed-off-by: Andrea Terzolo <[email protected]>
Copy link
Contributor

@FedeDP FedeDP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana
Copy link
Contributor

poiana commented Dec 16, 2024

LGTM label has been added.

Git tree hash: 5ee187ca2798f9234589300fc648d4b90f19b2f8

@poiana
Copy link
Contributor

poiana commented Dec 16, 2024

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@FedeDP FedeDP added this to the 0.20.0 milestone Dec 16, 2024
@poiana poiana merged commit 9ee57c8 into falcosecurity:master Dec 17, 2024
48 of 49 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants