[EBPF-589] Initialize process monitor as a module

[gjulianm]

What does this PR do?

This PR moves the initialization of ProcessMonitor to a single module, instead of each module initializing it by itself. It also introduces a new variable for the module.Factory called IgnoreForSuccessCheck, which ensures that system-probe will still fail initialization if other modules fail but the new process-monitor module is succesful.

Motivation

The ProcessMonitor object is a singleton, but needs to be initialized after all callbacks have been registered so that they receive events for existing processes. Since we have added the GPU monitoring and Dynamic Instrumentation modules which use the process monitor, it can no longer be initialized in the network tracer module. Another problem was that each module would try to initialize the process monitor with different options, causing inconsistencies there.

This is a temporary solution while we plan and develop a better way for system-probe to deal with these dependencies in a generic manner that guarantees proper ordering and initialization only when needed.

https://datadoghq.atlassian.net/browse/EBPF-589

Describe how to test/QA your changes

Tested locally by:

• starting system probe with USM, GPU, DI enabled and checking that the process monitor is initialized after their callbacks are registered (checking logs)
• Forcing a failure in all modules except the process monitor and checking that system-probe stops.

Possible Drawbacks / Trade-offs

Additional Notes

We have not introduced a new config to control the event stream, instead using the existing USM config (service_monitoring_config.enable_event_stream) despite that not being used only in USM anymore. A proper configuration option should be defined once we get a better system for managing these dependencies.

[agent-platform-auto-pr[bot]]

Test changes on VM

Use this command from test-infra-definitions to manually test this PR changes on a VM:

inv create-vm --pipeline-id=46934428 --os-family=ubuntu

Note: This applies to commit cfb6dbbd

[cit-pr-commenter[bot]]

Regression Detector

Regression Detector Results

Run ID: b8f44c5f-f4c0-4c3e-b7d0-59e539126535 Metrics dashboard Target profiles

Baseline: ddc0fd7eb678ae720484c1405e9ca46b0400c94c Comparison: cfb6dbbd56e7dc656bd10497e466987b3e8addbe

Performance changes are noted in the perf column of each table:

• ✅ = significantly better comparison variant performance
• ❌ = significantly worse comparison variant performance
• ➖ = no significant change in performance

No significant changes in experiment optimization goals

Confidence level: 90.00% Effect size tolerance: |Δ mean %| ≥ 5.00%

There were no significant changes in experiment optimization goals at this confidence level and effect size tolerance.

Fine details of change detection per experiment

perf	experiment	goal	Δ mean %	Δ mean % CI	trials	links
➖	uds_dogstatsd_to_api_cpu	% cpu utilization	+1.65	[+0.92, +2.38]	1	Logs
➖	basic_py_check	% cpu utilization	+1.07	[-1.66, +3.80]	1	Logs
➖	pycheck_lots_of_tags	% cpu utilization	+0.22	[-2.22, +2.67]	1	Logs
➖	file_to_blackhole_500ms_latency	egress throughput	+0.04	[-0.20, +0.29]	1	Logs
➖	file_to_blackhole_0ms_latency	egress throughput	+0.02	[-0.31, +0.35]	1	Logs
➖	uds_dogstatsd_to_api	ingress throughput	+0.01	[-0.09, +0.10]	1	Logs
➖	tcp_dd_logs_filter_exclude	ingress throughput	+0.00	[-0.01, +0.01]	1	Logs
➖	file_to_blackhole_100ms_latency	egress throughput	-0.03	[-0.25, +0.20]	1	Logs
➖	file_to_blackhole_300ms_latency	egress throughput	-0.14	[-0.31, +0.04]	1	Logs
➖	otel_to_otel_logs	ingress throughput	-0.14	[-0.95, +0.66]	1	Logs
➖	tcp_syslog_to_blackhole	ingress throughput	-0.19	[-0.24, -0.13]	1	Logs
➖	file_to_blackhole_1000ms_latency	egress throughput	-0.19	[-0.69, +0.30]	1	Logs
➖	file_tree	memory utilization	-0.26	[-0.39, -0.13]	1	Logs
➖	idle_all_features	memory utilization	-0.32	[-0.42, -0.23]	1	Logs bounds checks dashboard
➖	idle	memory utilization	-0.42	[-0.47, -0.37]	1	Logs bounds checks dashboard

Bounds Checks

perf	experiment	bounds_check_name	replicates_passed
✅	file_to_blackhole_0ms_latency	memory_usage	10/10
✅	file_to_blackhole_1000ms_latency	memory_usage	10/10
✅	file_to_blackhole_100ms_latency	memory_usage	10/10
✅	file_to_blackhole_300ms_latency	memory_usage	10/10
✅	file_to_blackhole_500ms_latency	memory_usage	10/10
✅	idle	memory_usage	10/10
✅	idle_all_features	memory_usage	10/10

Explanation

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.

2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.

3. Its configuration does not mark it "erratic".

[guyarb]

Why do you use USM process monitor? Why don't you move directly to eventmonitoring?

[gjulianm]

Why do you use USM process monitor? Why don't you move directly to eventmonitoring?

As far as I understand, the ProcessMonitor type encapsulates both the netlink and event stream methods of getting process start/exit events, no?

[guyarb]

Why do you use USM process monitor? Why don't you move directly to eventmonitoring?

As far as I understand, the ProcessMonitor type encapsulates both the netlink and event stream methods of getting process start/exit events, no?

It does, but process monitor is not an improvement, but a legacy component From the USM perspective, the process monitor (as a netlink wrapper) exists before the event stream monitoring project started. We didn't adapt event monitoring back then as it didn't fit USM needs (it had issues around consistency and accuracy of events). Only after all issues have been fixed we started our migration, and as a first phase - add the implementation to process monitor to limit the changes in usm. Eventually, we will adapt event monitoring fully and remove (or disable) netlink parts

[gjulianm]

It looks like the Processes team is tagged as a codeowner due to this rule

https://github.com/DataDog/datadog-agent/blob/3527f138432ecf119837add93a619e0bd85f04af/.github/CODEOWNERS#L231

Would you have the bandwidth to update it to only process.go instead of process*? No problem if you don't get to it, I can follow up with a separate PR.

Sorry about this, we're probably going to close this PR due to other concerns and follow up with a different approach, I forgot to notify your team about that.

[gjulianm]

Closing, as we have decided to remove the coupling between uprobe-attacher and process-monitor and use eventstream in DI/GPU, which will solve this problem.