From 942529bd31dd57427e34c600a2db58a0d5aad7f4 Mon Sep 17 00:00:00 2001
From: Vincent Whitchurch <vincent.whitchurch@datadoghq.com>
Date: Mon, 25 Nov 2024 18:03:46 +0100
Subject: [PATCH] usm: Enable event monitor if USM needs it (#31420)

---
 cmd/system-probe/config/adjust_usm.go  | 10 ++++++++++
 cmd/system-probe/config/config.go      |  1 +
 cmd/system-probe/config/config_test.go |  4 ++++
 3 files changed, 15 insertions(+)

diff --git a/cmd/system-probe/config/adjust_usm.go b/cmd/system-probe/config/adjust_usm.go
index d7e164a9020f1..e71679aa592ec 100644
--- a/cmd/system-probe/config/adjust_usm.go
+++ b/cmd/system-probe/config/adjust_usm.go
@@ -10,6 +10,7 @@ import (
 	"runtime"
 
 	"github.com/DataDog/datadog-agent/pkg/config/model"
+	"github.com/DataDog/datadog-agent/pkg/util/log"
 )
 
 const (
@@ -53,6 +54,15 @@ func adjustUSM(cfg model.Config) {
 		applyDefault(cfg, spNS("process_service_inference", "enabled"), false)
 	}
 
+	// Similar to the checkin in adjustNPM(). The process event data stream and USM have the same
+	// minimum kernel version requirement, but USM's check for that is done
+	// later.  This check here prevents the EventMonitorModule from getting
+	// enabled on unsupported kernels by load() in config.go.
+	if cfg.GetBool(smNS("enable_event_stream")) && !ProcessEventDataStreamSupported() {
+		log.Warn("disabling USM event stream as it is not supported for this kernel version")
+		cfg.Set(smNS("enable_event_stream"), false, model.SourceAgentRuntime)
+	}
+
 	applyDefault(cfg, spNS("process_service_inference", "use_windows_service_name"), true)
 	applyDefault(cfg, smNS("enable_ring_buffers"), true)
 	applyDefault(cfg, smNS("max_postgres_stats_buffered"), 100000)
diff --git a/cmd/system-probe/config/config.go b/cmd/system-probe/config/config.go
index 49fd3e49d290c..c67bd69c18aca 100644
--- a/cmd/system-probe/config/config.go
+++ b/cmd/system-probe/config/config.go
@@ -137,6 +137,7 @@ func load() (*types.Config, error) {
 	if cfg.GetBool(secNS("enabled")) ||
 		cfg.GetBool(secNS("fim_enabled")) ||
 		cfg.GetBool(evNS("process.enabled")) ||
+		(usmEnabled && cfg.GetBool(smNS("enable_event_stream"))) ||
 		(c.ModuleIsEnabled(NetworkTracerModule) && cfg.GetBool(evNS("network_process.enabled")) ||
 			gpuEnabled) {
 		c.EnabledModules[EventMonitorModule] = struct{}{}
diff --git a/cmd/system-probe/config/config_test.go b/cmd/system-probe/config/config_test.go
index 4b44204851a0b..9611f6f9eed87 100644
--- a/cmd/system-probe/config/config_test.go
+++ b/cmd/system-probe/config/config_test.go
@@ -24,6 +24,7 @@ func TestEventMonitor(t *testing.T) {
 
 	for i, tc := range []struct {
 		cws, fim, processEvents, networkEvents, gpu bool
+		usmEvents                                   bool
 		enabled                                     bool
 	}{
 		{cws: false, fim: false, processEvents: false, networkEvents: false, enabled: false},
@@ -43,6 +44,7 @@ func TestEventMonitor(t *testing.T) {
 		{cws: true, fim: true, processEvents: false, networkEvents: true, enabled: true},
 		{cws: true, fim: true, processEvents: true, networkEvents: true, enabled: true},
 		{cws: false, fim: false, processEvents: false, networkEvents: false, gpu: true, enabled: true},
+		{usmEvents: true, enabled: true},
 	} {
 		t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
 			t.Logf("%+v\n", tc)
@@ -52,6 +54,8 @@ func TestEventMonitor(t *testing.T) {
 			t.Setenv("DD_SYSTEM_PROBE_EVENT_MONITORING_NETWORK_PROCESS_ENABLED", strconv.FormatBool(tc.networkEvents))
 			t.Setenv("DD_SYSTEM_PROBE_NETWORK_ENABLED", strconv.FormatBool(tc.networkEvents))
 			t.Setenv("DD_GPU_MONITORING_ENABLED", strconv.FormatBool(tc.gpu))
+			t.Setenv("DD_SYSTEM_PROBE_SERVICE_MONITORING_ENABLED", strconv.FormatBool(tc.usmEvents))
+			t.Setenv("DD_SERVICE_MONITORING_CONFIG_ENABLE_EVENT_STREAM", strconv.FormatBool(tc.usmEvents))
 
 			cfg, err := New("/doesnotexist", "")
 			t.Logf("%+v\n", cfg)