tetragon
tetragon copied to clipboard
feat: include ancestors in process events
Fixes 2420
Description
Reason: Option to include all ancestors of the process in process events can be very useful for observability and filtering purposes. E.g. to apply complex correlation rules later in data processing pipeline, or to filter out extra events.
Changes made:
- Read and set option
enable-process-ancestors
from the config file. Turn optionenable-process-ancestors
off by default. - If option
enable-process-ancestors
is set, try to include ancestors (up to PID 1/PID 2) of the process beyond the immediate parent inprocess_exec
,process_exit
,process_uprobe
,process_kprobe
,process_lsm
,process_tracepoint
events in a respective protobuf message for the given process. - If option
enable-process-ancestors
is set and there was an error when trying to include process' ancestors in the protobuf message, add the event to eventcache for reprocessing. - When trying to reprocess events from eventcache, if option
enable-process-ancestors
is set andAncestors
is nil, try to include process' ancestors again. - Implement a new export filter that can filter over ancestor binary names using RE2 regular expressions.
- Add a new test for the new export filter.
- Add information about new features to documentation.