wip

Signed-off-by: Gianmatteo Palmieri <[email protected]>

userspace/libsinsp/CMakeLists.txt

@@ -112,6 +112,13 @@ add_library(
 	events/sinsp_events_ppm_sc.cpp
 )
 
+if(NOT WIN32
+   AND NOT APPLE
+   AND NOT EMSCRIPTEN
+)
+	target_sources(sinsp PRIVATE linux/resource_utilization.cpp)
+endif()
+
 if(ENABLE_THREAD_POOL AND NOT EMSCRIPTEN)
 	target_sources(sinsp PRIVATE sinsp_thread_pool_bs.cpp)
 endif()

userspace/libsinsp/linux/resource_utilization.cpp

@@ -0,0 +1,283 @@
+#include <libsinsp/linux/resource_utilization.h>
+
+#include <sys/times.h>
+
+void linux_resource_utilization::get_rss_vsz_pss_total_memory_and_open_fds() {
+	FILE* f;
+	char filepath[512];
+	char line[512];
+
+	/*
+	 * Get memory usage of the agent itself (referred to as calling process meaning /proc/self/)
+	 */
+
+	//  No need for scap_get_host_root since we look at the agents' own process, accessible from
+	//  it's own pid namespace (if applicable)
+	f = fopen("/proc/self/status", "r");
+	if(!f) {
+		return;
+	}
+
+	while(fgets(line, sizeof(line), f) != nullptr) {
+		if(strncmp(line, "VmSize:", 7) == 0) {
+			sscanf(line, "VmSize: %" SCNu32, &m_vsz); /* memory size returned in kb */
+		} else if(strncmp(line, "VmRSS:", 6) == 0) {
+			sscanf(line, "VmRSS: %" SCNu32, &m_rss); /* memory size returned in kb */
+		}
+	}
+	fclose(f);
+
+	//  No need for scap_get_host_root since we look at the agents' own process, accessible from
+	//  it's own pid namespace (if applicable)
+	f = fopen("/proc/self/smaps_rollup", "r");
+	if(!f) {
+		ASSERT(false);
+		return;
+	}
+
+	while(fgets(line, sizeof(line), f) != NULL) {
+		if(strncmp(line, "Pss:", 4) == 0) {
+			sscanf(line, "Pss: %" SCNu32, &m_pss); /* memory size returned in kb */
+			break;
+		}
+	}
+	fclose(f);
+
+	/*
+	 * Get total host memory usage
+	 */
+
+	// Using scap_get_host_root since we look at the memory usage of the underlying host
+	snprintf(filepath, sizeof(filepath), "%s/proc/meminfo", scap_get_host_root());
+	f = fopen(filepath, "r");
+	if(!f) {
+		ASSERT(false);
+		return;
+	}
+
+	uint64_t mem_total, mem_free, mem_buff, mem_cache = 0;
+
+	while(fgets(line, sizeof(line), f) != NULL) {
+		if(strncmp(line, "MemTotal:", 9) == 0) {
+			sscanf(line, "MemTotal: %" SCNu64, &mem_total); /* memory size returned in kb */
+		} else if(strncmp(line, "MemFree:", 8) == 0) {
+			sscanf(line, "MemFree: %" SCNu64, &mem_free); /* memory size returned in kb */
+		} else if(strncmp(line, "Buffers:", 8) == 0) {
+			sscanf(line, "Buffers: %" SCNu64, &mem_buff); /* memory size returned in kb */
+		} else if(strncmp(line, "Cached:", 7) == 0) {
+			sscanf(line, "Cached: %" SCNu64, &mem_cache); /* memory size returned in kb */
+		}
+	}
+	fclose(f);
+	m_host_memory_used = mem_total - mem_free - mem_buff - mem_cache;
+
+	/*
+	 * Get total number of allocated file descriptors (not all open files!)
+	 * File descriptor is a data structure used by a program to get a handle on a file
+	 */
+
+	// Using scap_get_host_root since we look at the total open fds of the underlying host
+	snprintf(filepath, sizeof(filepath), "%s/proc/sys/fs/file-nr", scap_get_host_root());
+	f = fopen(filepath, "r");
+	if(!f) {
+		ASSERT(false);
+		return;
+	}
+	int matched_fds = fscanf(f, "%" SCNu64, &m_host_open_fds);
+	fclose(f);
+
+	if(matched_fds != 1) {
+		ASSERT(false);
+		return;
+	}
+}
+
+void linux_resource_utilization::get_cpu_usage_and_total_procs(double start_time) {
+	FILE* f;
+	char filepath[512];
+	char line[512];
+
+	struct tms time;
+	if(times(&time) == (clock_t)-1) {
+		return;
+	}
+
+	/* Number of clock ticks per second, often referred to as USER_HZ / jiffies. */
+	long hz = 100;
+#ifdef _SC_CLK_TCK
+	if((hz = sysconf(_SC_CLK_TCK)) < 0) {
+		ASSERT(false);
+		hz = 100;
+	}
+#endif
+	/* Current uptime of the host machine in seconds.
+	 * /proc/uptime offers higher precision w/ 2 decimals.
+	 */
+
+	// Using scap_get_host_root since we look at the uptime of the underlying host
+	snprintf(filepath, sizeof(filepath), "%s/proc/uptime", scap_get_host_root());
+	f = fopen(filepath, "r");
+	if(!f) {
+		ASSERT(false);
+		return;
+	}
+
+	double machine_uptime_sec = 0;
+	int matched_uptime = fscanf(f, "%lf", &machine_uptime_sec);
+	fclose(f);
+
+	if(matched_uptime != 1) {
+		ASSERT(false);
+		return;
+	}
+
+	/*
+	 * Get CPU usage of the agent itself (referred to as calling process meaning /proc/self/)
+	 */
+
+	/* Current utime is amount of processor time in user mode of calling process. Convert to
+	 * seconds. */
+	double user_sec = (double)time.tms_utime / hz;
+
+	/* Current stime is amount of time the calling process has been scheduled in kernel mode.
+	 * Convert to seconds. */
+	double system_sec = (double)time.tms_stime / hz;
+
+	/* CPU usage as percentage is computed by dividing the time the process uses the CPU by the
+	 * currently elapsed time of the calling process. Compare to `ps` linux util. */
+	double elapsed_sec = machine_uptime_sec - start_time;
+	if(elapsed_sec > 0) {
+		m_cpu_usage_perc = (double)100.0 * (user_sec + system_sec) / elapsed_sec;
+		m_cpu_usage_perc = std::round(m_cpu_usage_perc * 10.0) / 10.0;  // round to 1 decimal
+	}
+
+	/*
+	 * Get total host CPU usage (all CPUs) as percentage and retrieve number of procs currently
+	 * running.
+	 */
+
+	// Using scap_get_host_root since we look at the total CPU usage of the underlying host
+	snprintf(filepath, sizeof(filepath), "%s/proc/stat", scap_get_host_root());
+	f = fopen(filepath, "r");
+	if(!f) {
+		ASSERT(false);
+		return;
+	}
+
+	/* Need only first 7 columns of /proc/stat cpu line */
+	uint64_t user, nice, system, idle, iowait, irq, softirq = 0;
+	while(fgets(line, sizeof(line), f) != NULL) {
+		if(strncmp(line, "cpu ", 4) == 0) {
+			/* Always first line in /proc/stat file, unit: jiffies */
+			sscanf(line,
+			       "cpu %" SCNu64 " %" SCNu64 " %" SCNu64 " %" SCNu64 " %" SCNu64 " %" SCNu64
+			       " %" SCNu64,
+			       &user,
+			       &nice,
+			       &system,
+			       &idle,
+			       &iowait,
+			       &irq,
+			       &softirq);
+		} else if(strncmp(line, "procs_running ", 14) == 0) {
+			sscanf(line, "procs_running %" SCNu32, &m_host_procs_running);
+			break;
+		}
+	}
+	fclose(f);
+	auto sum = user + nice + system + idle + iowait + irq + softirq;
+	if(sum > 0) {
+		m_host_cpu_usage_perc = 100.0 - ((idle * 100.0) / sum);
+		m_host_cpu_usage_perc =
+		        std::round(m_host_cpu_usage_perc * 10.0) / 10.0;  // round to 1 decimal
+	}
+}
+
+std::vector<metrics_v2> linux_resource_utilization::to_metrics() {
+	std::vector<metrics_v2> metrics;
+	metrics.emplace_back(new_metric("cpu_usage_perc",
+	                                METRICS_V2_RESOURCE_UTILIZATION,
+	                                METRIC_VALUE_TYPE_D,
+	                                METRIC_VALUE_UNIT_PERC,
+	                                METRIC_VALUE_METRIC_TYPE_NON_MONOTONIC_CURRENT,
+	                                m_cpu_usage_perc));
+	metrics.emplace_back(new_metric("memory_rss_kb",
+	                                METRICS_V2_RESOURCE_UTILIZATION,
+	                                METRIC_VALUE_TYPE_U32,
+	                                METRIC_VALUE_UNIT_MEMORY_KIBIBYTES,
+	                                METRIC_VALUE_METRIC_TYPE_NON_MONOTONIC_CURRENT,
+	                                m_rss));
+	metrics.emplace_back(new_metric("memory_vsz_kb",
+	                                METRICS_V2_RESOURCE_UTILIZATION,
+	                                METRIC_VALUE_TYPE_U32,
+	                                METRIC_VALUE_UNIT_MEMORY_KIBIBYTES,
+	                                METRIC_VALUE_METRIC_TYPE_NON_MONOTONIC_CURRENT,
+	                                m_vsz));
+	metrics.emplace_back(new_metric("memory_pss_kb",
+	                                METRICS_V2_RESOURCE_UTILIZATION,
+	                                METRIC_VALUE_TYPE_U32,
+	                                METRIC_VALUE_UNIT_MEMORY_KIBIBYTES,
+	                                METRIC_VALUE_METRIC_TYPE_NON_MONOTONIC_CURRENT,
+	                                m_pss));
+	metrics.emplace_back(new_metric("container_memory_used_bytes",
+	                                METRICS_V2_RESOURCE_UTILIZATION,
+	                                METRIC_VALUE_TYPE_U64,
+	                                METRIC_VALUE_UNIT_MEMORY_BYTES,
+	                                METRIC_VALUE_METRIC_TYPE_NON_MONOTONIC_CURRENT,
+	                                m_container_memory_used));
+	metrics.emplace_back(new_metric("host_cpu_usage_perc",
+	                                METRICS_V2_RESOURCE_UTILIZATION,
+	                                METRIC_VALUE_TYPE_D,
+	                                METRIC_VALUE_UNIT_PERC,
+	                                METRIC_VALUE_METRIC_TYPE_NON_MONOTONIC_CURRENT,
+	                                m_host_cpu_usage_perc));
+	metrics.emplace_back(new_metric("host_memory_used_kb",
+	                                METRICS_V2_RESOURCE_UTILIZATION,
+	                                METRIC_VALUE_TYPE_U32,
+	                                METRIC_VALUE_UNIT_MEMORY_KIBIBYTES,
+	                                METRIC_VALUE_METRIC_TYPE_NON_MONOTONIC_CURRENT,
+	                                m_host_memory_used));
+	metrics.emplace_back(new_metric("host_procs_running",
+	                                METRICS_V2_RESOURCE_UTILIZATION,
+	                                METRIC_VALUE_TYPE_U32,
+	                                METRIC_VALUE_UNIT_COUNT,
+	                                METRIC_VALUE_METRIC_TYPE_NON_MONOTONIC_CURRENT,
+	                                m_host_procs_running));
+	metrics.emplace_back(new_metric("host_open_fds",
+	                                METRICS_V2_RESOURCE_UTILIZATION,
+	                                METRIC_VALUE_TYPE_U64,
+	                                METRIC_VALUE_UNIT_COUNT,
+	                                METRIC_VALUE_METRIC_TYPE_NON_MONOTONIC_CURRENT,
+	                                m_host_open_fds));
+
+	return metrics;
+}
+
+void linux_resource_utilization::get_container_memory_used() {
+	/* In Kubernetes `container_memory_working_set_bytes` is the memory measure the OOM killer uses
+	 * and values from `/sys/fs/cgroup/memory/memory.usage_in_bytes` are close enough.
+	 *
+	 * Please note that `kubectl top pod` numbers would reflect the sum of containers in a pod and
+	 * typically libs clients (e.g. Falco) pods contain sidekick containers that use memory as well.
+	 * This metric accounts only for the container with the security monitoring agent running.
+	 */
+	const char* filepath = getenv(SINSP_AGENT_CGROUP_MEM_PATH_ENV_VAR);
+	if(filepath == nullptr) {
+		// No need for scap_get_host_root since we look at the container pid namespace (if
+		// applicable) Known collision for VM memory usage, but this default value is configurable
+		filepath = "/sys/fs/cgroup/memory/memory.usage_in_bytes";
+	}
+
+	FILE* f = fopen(filepath, "r");
+	if(!f) {
+		return;
+	}
+
+	/* memory size returned in bytes */
+	int fscanf_matched = fscanf(f, "%" SCNu64, &m_container_memory_used);
+	if(fscanf_matched != 1) {
+		m_container_memory_used = 0;
+	}
+
+	fclose(f);
+}

userspace/libsinsp/linux/resource_utilization.h

@@ -0,0 +1,42 @@
+#include <libsinsp/metrics_collector.h>
+
+class linux_resource_utilization : libs::metrics::libsinsp_metrics {
+public:
+	linux_resource_utilization(double start_time) {
+		get_cpu_usage_and_total_procs(start_time);
+		get_rss_vsz_pss_total_memory_and_open_fds();
+		get_container_memory_used();
+	}
+
+	std::vector<metrics_v2> to_metrics();
+
+private:
+	void get_cpu_usage_and_total_procs(double start_time);
+	void get_rss_vsz_pss_total_memory_and_open_fds();
+	void get_container_memory_used();
+
+	double m_cpu_usage_perc{};  ///< Current CPU usage, `ps` util like calculation for the calling
+	                            ///< process (/proc/self), unit: percentage of one CPU.
+
+	uint32_t m_rss{};  ///< Current RSS (Resident Set Size), calculated based on /proc/self/status
+	                   ///< info, unit: kb.
+	uint32_t m_vsz{};  ///< Current VSZ (Virtual Memory Size), calculated based on /proc/self/status
+	                   ///< info, unit: kb.
+	uint32_t m_pss{};  ///< Current PSS (Proportional Set Size), calculated based on
+	                   ///< /proc/self/smaps_rollup info, unit: kb.
+
+	uint64_t m_container_memory_used{};  ///< Cgroup current memory used, default Kubernetes
+	                                     ///< /sys/fs/cgroup/memory/memory.usage_in_bytes, unit:
+	                                     ///< bytes.
+
+	double m_host_cpu_usage_perc{};   ///< Current total host CPU usage (all CPUs), calculated based
+	                                  ///< on ${HOST_ROOT}/proc/stat info, unit: percentage.
+	uint64_t m_host_memory_used{};    ///< Current total memory used out of available host memory,
+	                                  ///< calculated based on ${HOST_ROOT}/proc/meminfo info, unit:
+	                                  ///< kb.
+	uint32_t m_host_procs_running{};  ///< Number of processes currently running on CPUs on the
+	                                  ///< host, retrieved from ${HOST_ROOT}/proc/stat line
+	                                  ///< `procs_running`, unit: count.
+	uint64_t m_host_open_fds{};       ///< Number of allocated fds on the host, retrieved from
+	                                  ///< ${HOST_ROOT}/proc/sys/fs/file-nr, unit: count.
+};