Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for a StoppingEvent on CollectTrace action #2557

Merged
merged 28 commits into from
Oct 11, 2022
Merged
Show file tree
Hide file tree
Changes from 27 commits
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
36710dd
Add initial stop-on-event support
schmittjoseph Sep 13, 2022
ace9595
Add comment
schmittjoseph Sep 13, 2022
efd186c
Simplify opcode detection
schmittjoseph Sep 26, 2022
5110bce
Add payload filtering
schmittjoseph Sep 26, 2022
d14f066
Add logger statements
schmittjoseph Sep 26, 2022
f212cd0
Fix resx help comment
schmittjoseph Sep 26, 2022
6f4f6d1
Merge remote-tracking branch 'origin/main' into stop-trace-on-event
schmittjoseph Sep 26, 2022
623e868
Support calling onEvent only once
schmittjoseph Sep 26, 2022
60aa45b
Update resx comment
schmittjoseph Sep 26, 2022
4fb8a28
Improve schema docs
schmittjoseph Sep 26, 2022
eef1097
Update schema docs for payload filtering
schmittjoseph Sep 26, 2022
fdee6f2
Handle null invoke
schmittjoseph Sep 26, 2022
7a709e3
Run formatter
schmittjoseph Sep 26, 2022
f306041
Run formatter
schmittjoseph Sep 26, 2022
0856edb
Fix comment
schmittjoseph Sep 26, 2022
602dfba
Update docs
schmittjoseph Sep 26, 2022
17b92fc
Merge
schmittjoseph Sep 26, 2022
2bcf5c2
Make payload comparison invariant
schmittjoseph Sep 27, 2022
61ecd54
Set cache capacity
schmittjoseph Sep 27, 2022
2435072
Avoid extra payload field iterations during cache hydration
schmittjoseph Sep 27, 2022
6a157a5
Remove unneeded lock
schmittjoseph Sep 27, 2022
2dc0d10
Address PR feedback
schmittjoseph Sep 30, 2022
e0d22c4
Apply suggestions from code review
schmittjoseph Oct 3, 2022
076ec19
Address PR feedback
schmittjoseph Oct 3, 2022
ebc9c63
Add missing dispose
schmittjoseph Oct 3, 2022
986ae74
Address PR feedback
schmittjoseph Oct 10, 2022
74ed0bc
Address PR feedback
schmittjoseph Oct 10, 2022
c464779
Address PR feedback
schmittjoseph Oct 11, 2022
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions documentation/api/definitions.md
Original file line number Diff line number Diff line change
Expand Up @@ -351,6 +351,16 @@ The `uid` property is useful for uniquely identifying a process when it is runni
"processArchitecture": "x64"
}
```
## TraceEventFilter

Object describing a filter for trace events.

| Name | Type | Description |
|---|---|---|
| `ProviderName` | string | The event provider that will produce the specified event. |
| `EventName` | string | The name of the event, which is a concatenation of the task name and opcode name, if any. The task and opcode names are separated by a '/'. If the event has no opcode, then the event name is just the task name. |
| `PayloadFilter` | map (of string) | (Optional) A mapping of event payload field names to their expected value. A subset of the payload fields may be specified. |


## TraceProfile

Expand Down
1 change: 1 addition & 0 deletions documentation/configuration.md
Original file line number Diff line number Diff line change
Expand Up @@ -1421,6 +1421,7 @@ An action that collects a trace of the process that the collection rule is targe
| `BufferSizeMegabytes` | int | false | The size (in megabytes) of the event buffer used in the runtime. If the event buffer is filled, events produced by event providers may be dropped until the buffer is cleared. Increase the buffer size to mitigate this or pair down the list of event providers, keywords, and level to filter out extraneous events. Only applies when `Providers` is specified. | `256` | `1` | `1024` |
| `Duration` | TimeSpan? | false | The duration of the trace operation. | `"00:00:30"` (30 seconds) | `"00:00:01"` (1 second) | `"1.00:00:00"` (1 day) |
| `Egress` | string | true | The named [egress provider](egress.md) for egressing the collected trace. | | | |
| `StoppingEvent` | [TraceEventFilter](api/definitions.md#traceeventfilter)? | false | The event to watch for while collecting the trace, and once either the event is hit or the `Duration` is reached the trace will be stopped. This can only be specified if `Providers` is set. | `null` | | |
schmittjoseph marked this conversation as resolved.
Show resolved Hide resolved
schmittjoseph marked this conversation as resolved.
Show resolved Hide resolved

##### Outputs

Expand Down
41 changes: 41 additions & 0 deletions documentation/schema.json
Original file line number Diff line number Diff line change
Expand Up @@ -1722,6 +1722,17 @@
"type": "string",
"description": "The name of the egress provider to which the trace is egressed.",
"minLength": 1
},
"StoppingEvent": {
"description": "The event to watch for while collecting the trace, and once observed the trace will be stopped.",
"oneOf": [
{
"type": "null"
},
{
"$ref": "#/definitions/TraceEventFilter"
}
]
}
}
},
Expand Down Expand Up @@ -1793,6 +1804,36 @@
"Verbose"
]
},
"TraceEventFilter": {
"type": "object",
"additionalProperties": false,
"required": [
"ProviderName",
"EventName"
],
"properties": {
"ProviderName": {
"type": "string",
"description": "The event provider that will produce the specified event.",
"minLength": 1
},
"EventName": {
"type": "string",
"description": "The name of the event, which is a concatenation of the task name and opcode name, if any. The task and opcode names are separated by a '/'. If the event has no opcode, then the event name is just the task name.",
"minLength": 1
},
"PayloadFilter": {
"type": [
"null",
"object"
],
"description": "A mapping of event payload field names to their expected value. A subset of the payload fields may be specified.",
"additionalProperties": {
"type": "string"
}
}
}
},
"ExecuteOptions": {
"type": "object",
"additionalProperties": false,
Expand Down

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Original file line number Diff line number Diff line change
Expand Up @@ -729,4 +729,20 @@
<data name="DisplayAttributeDescription_CollectStacksOptions_Egress" xml:space="preserve">
<value>The name of the egress provider to which the call stacks are egressed.</value>
</data>
<data name="DisplayAttributeDescription_CollectTraceOptions_StoppingEvent" xml:space="preserve">
<value>The event to watch for while collecting the trace, and once observed the trace will be stopped.</value>
<comment>The description provided for the StoppingEvent parameter on CollectTraceOptions.</comment>
</data>
<data name="DisplayAttributeDescription_TraceEventFilter_EventName" xml:space="preserve">
<value>The name of the event, which is a concatenation of the task name and opcode name, if any. The task and opcode names are separated by a '/'. If the event has no opcode, then the event name is just the task name.</value>
<comment>The description provided for the EventName parameter on TraceEventFilter.</comment>
</data>
<data name="DisplayAttributeDescription_TraceEventFilter_ProviderName" xml:space="preserve">
<value>The event provider that will produce the specified event.</value>
<comment>The description provided for the ProviderName parameter on TraceEventFilter.</comment>
</data>
<data name="DisplayAttributeDescription_TraceEventFilter_PayloadFilter" xml:space="preserve">
<value>A mapping of event payload field names to their expected value. A subset of the payload fields may be specified.</value>
<comment>The description provided for the PayloadFilter parameter on TraceEventFilter.</comment>
</data>
</root>
Loading