Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(time)!: epoch timestamps as standard #4252

Merged
merged 4 commits into from
Sep 18, 2024

Conversation

NDStrahilevitz
Copy link
Collaborator

@NDStrahilevitz NDStrahilevitz commented Aug 14, 2024

1. Explain what the PR does

1486115 feat(time): normalize all time to epoch
fbbe9f9 feat(output)!: remove relative-time
1a55bdb chore(pipeline): streamline time args normalization
18d3abd chore: refactor time pkg

1486115 feat(time): normalize all time to epoch

Remove all timeNormalizer object logic. Instead use simple normalization
functions and normalize all timestamps in events asap:
1. Context timestamp normalization moved to decode stage
2. Relevant timestamp arguments normalized in processing stage,
   registered to run first.

1a55bdb chore(pipeline): streamline time args normalization

Instead of using a helper, and then using it in a specialized processor
function - use function currying to enable creating generic time argument
processors.

2. Explain how to test it

  1. running with -o option:relative-time should fail
  2. event context timestamps should be epoch
  3. sched_process_fork timestamps in args should be epoch (relevant args are parent_start_time, start_time, leader_start_time, parent_process_start_time)

3. Other comments

Resolve #4287
Resolve #3820

pkg/ebpf/tracee.go Outdated Show resolved Hide resolved
@NDStrahilevitz
Copy link
Collaborator Author

@geyslan Is the PR ok besides the change you've commented on? I will drop that commit since it's irrelevant.

geyslan
geyslan previously approved these changes Aug 26, 2024
Copy link
Member

@geyslan geyslan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@NDStrahilevitz NDStrahilevitz force-pushed the time_cleanups branch 2 times, most recently from 69318a0 to 37db421 Compare September 3, 2024 13:05
@NDStrahilevitz NDStrahilevitz force-pushed the time_cleanups branch 2 times, most recently from 8b545a9 to c1ea067 Compare September 10, 2024 14:04
@NDStrahilevitz NDStrahilevitz changed the title chore: various time related cleanups feat(time): epoch timestamps as standard Sep 10, 2024
@NDStrahilevitz NDStrahilevitz force-pushed the time_cleanups branch 3 times, most recently from 426adc8 to 3423902 Compare September 10, 2024 14:27
@geyslan geyslan changed the title feat(time): epoch timestamps as standard feat(time)!: epoch timestamps as standard Sep 10, 2024
@geyslan
Copy link
Member

geyslan commented Sep 10, 2024

When rebasing, please put ! in the breaking changes commits, like I did in the PR header. Tks.

@NDStrahilevitz
Copy link
Collaborator Author

@rscampos Could you review this?

@NDStrahilevitz NDStrahilevitz dismissed geyslan’s stale review September 13, 2024 16:25

Changes made since review

Copy link
Collaborator

@rscampos rscampos left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

func Init(clockID int32) error {
var err error
initTimeOnce.Do(func() {
startTimeMonotonic, errIn := getClockTimeNS(clockID)
Copy link
Collaborator

@rscampos rscampos Sep 16, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: The variable startTimeMonotonic could represent either the result from a Monotonic or Boottime clock, depending on the value of clockID, right?. Therefore, it may be a good idea to consider renaming the variable (also in the rest of the function) to better reflect this.

@@ -208,7 +214,7 @@ func (ctrl *Controller) procTreeExitProcessor(args []trace.Argument) error {

return ctrl.processTree.FeedFromExit(
proctree.ExitFeed{
TimeStamp: uint64(ctrl.timeNormalizer.NormalizeTime(int(timestamp))), // time of exit is already a timestamp
TimeStamp: time.BootToEpochNS(timestamp), // time of exit is already a times)p
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

comment typo: timestamp

Instead of using a helper, and then using it in a specialized processor
function - use function currying to enable creating generic time argument
processors.
Remove all timeNormalizer object logic. Instead use simple normalization
functions and normalize all timestamps in events asap:
1. Context timestamp normalization moved to decode stage
2. Relevant timestamp arguments normalized in processing stage,
   registered to run first.
@NDStrahilevitz NDStrahilevitz merged commit 3233f0b into aquasecurity:main Sep 18, 2024
31 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

feature: epoch timestamps as a standard Processor functions order lead to problems with timestamps
3 participants