Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(libsinsp): make proc.p* (proc.pname...) behave like proc.a*[1] (proc.aname...) #2230

Merged
merged 6 commits into from
Jan 13, 2025

Conversation

LucaGuerra
Copy link
Contributor

@LucaGuerra LucaGuerra commented Jan 10, 2025

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area libsinsp

Does this PR require a change in the driver versions?

No

What this PR does / why we need it:

I have worked with @loresuso on this. He noticed that when a process calls a vforks from a previously created thread (not the main thread) we see that:

  • proc.ppid returns the parent thread id. This is not expected, ppid is defined as "The pid of the parent of the process generating the event."
  • proc.apid[1] correctly returns the parent process pid

This PR makes them behave the same.

There is also some extra cleanup of a commented function part.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

fix(libsinsp)!: make proc.p* (proc.pname...) behave like proc.a*[1] (proc.aname...)

Copy link

github-actions bot commented Jan 10, 2025

Perf diff from master - unit tests

     4.68%     -0.83%  [.] gzfile_read
     3.22%     -0.52%  [.] sinsp_thread_manager::get_thread_ref
     3.29%     +0.50%  [.] sinsp_evt::load_params
     1.99%     +0.48%  [.] is_conversion_needed
    10.71%     +0.37%  [.] sinsp::next
     3.18%     -0.37%  [.] sinsp_thread_manager::find_thread
     0.48%     +0.35%  [.] 0x00000000000fc5b0
     1.52%     +0.30%  [.] next
     1.86%     -0.27%  [.] libsinsp::sinsp_suppress::process_event
     0.55%     -0.22%  [.] sinsp_evt::is_filtered_out

Heap diff from master - unit tests

peak heap memory consumption: -750B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Heap diff from master - scap file

peak heap memory consumption: -21B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Benchmarks diff from master

Comparing gbench_data.json to /root/actions-runner/_work/libs/libs/build/gbench_data.json
Benchmark                                                         Time             CPU      Time Old      Time New       CPU Old       CPU New
----------------------------------------------------------------------------------------------------------------------------------------------
BM_sinsp_split_mean                                            -0.0038         -0.0038           151           150           151           150
BM_sinsp_split_median                                          -0.0050         -0.0050           151           150           151           150
BM_sinsp_split_stddev                                          -0.4787         -0.4789             2             1             2             1
BM_sinsp_split_cv                                              -0.4767         -0.4769             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_mean                  -0.0002         -0.0002            56            56            56            56
BM_sinsp_concatenate_paths_relative_path_median                -0.0003         -0.0003            56            56            56            56
BM_sinsp_concatenate_paths_relative_path_stddev                +0.2100         +0.2104             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_cv                    +0.2102         +0.2107             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_mean                     -0.0422         -0.0422            25            24            25            24
BM_sinsp_concatenate_paths_empty_path_median                   -0.0346         -0.0346            25            24            25            24
BM_sinsp_concatenate_paths_empty_path_stddev                   -0.8858         -0.8857             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_cv                       -0.8808         -0.8807             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_mean                  +0.0283         +0.0283            55            57            55            57
BM_sinsp_concatenate_paths_absolute_path_median                +0.0239         +0.0239            55            56            55            56
BM_sinsp_concatenate_paths_absolute_path_stddev                +0.5323         +0.5317             1             1             1             1
BM_sinsp_concatenate_paths_absolute_path_cv                    +0.4901         +0.4895             0             0             0             0
BM_sinsp_split_container_image_mean                            +0.0359         +0.0359           384           398           384           398
BM_sinsp_split_container_image_median                          +0.0366         +0.0367           384           398           384           398
BM_sinsp_split_container_image_stddev                          +0.2082         +0.2081             3             4             3             4
BM_sinsp_split_container_image_cv                              +0.1664         +0.1663             0             0             0             0

Copy link

codecov bot commented Jan 10, 2025

Codecov Report

Attention: Patch coverage is 88.88889% with 7 lines in your changes missing coverage. Please review.

Project coverage is 75.09%. Comparing base (bd0bb9b) to head (a143296).
Report is 7 commits behind head on master.

Files with missing lines Patch % Lines
userspace/libsinsp/sinsp_filtercheck_thread.cpp 81.57% 7 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #2230      +/-   ##
==========================================
- Coverage   75.10%   75.09%   -0.02%     
==========================================
  Files         274      274              
  Lines       34302    34290      -12     
  Branches     5933     5925       -8     
==========================================
- Hits        25763    25749      -14     
- Misses       8539     8541       +2     
Flag Coverage Δ
libsinsp 75.09% <88.88%> (-0.02%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@LucaGuerra
Copy link
Contributor Author

/milestone 0.20.0

@poiana poiana added this to the 0.20.0 milestone Jan 13, 2025
Copy link
Contributor

@FedeDP FedeDP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, left a question.


\return Pointer to the threadinfo or NULL if it doesn't exist
*/
sinsp_threadinfo* get_ancestor_process(uint32_t n = 1);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Really like the new API!

userspace/libsinsp/test/events_proc.ut.cpp Show resolved Hide resolved
Copy link
Contributor

@FedeDP FedeDP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana
Copy link
Contributor

poiana commented Jan 13, 2025

LGTM label has been added.

Git tree hash: 031a6c77565c6bd85bd73ccd1ddbff43d51044dc

@poiana
Copy link
Contributor

poiana commented Jan 13, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: FedeDP, LucaGuerra

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana merged commit 431ba43 into falcosecurity:master Jan 13, 2025
48 of 49 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants