Record metrics for device manager startup operations (#1218)

* Record metrics for device manager startup operations * Update help text * Update help text
google · Nov 3, 2023 · f9a937a · f9a937a
1 parent d2cbddd
commit f9a937a
Show file tree

Hide file tree

Showing 4 changed files with 36 additions and 2 deletions.
diff --git a/Source/santad/BUILD b/Source/santad/BUILD
@@ -398,6 +398,7 @@ objc_library(
         "//Source/common:SNTCommonEnums",
         "//Source/common:SNTDeviceEvent",
         "//Source/common:SNTLogging",
+        "//Source/common:SNTMetricSet",
     ],
 )
 

diff --git a/Source/santad/EventProviders/SNTEndpointSecurityDeviceManager.mm b/Source/santad/EventProviders/SNTEndpointSecurityDeviceManager.mm
@@ -29,6 +29,7 @@
 
 #import "Source/common/SNTDeviceEvent.h"
 #import "Source/common/SNTLogging.h"
+#import "Source/common/SNTMetricSet.h"
 #include "Source/santad/EventProviders/EndpointSecurity/Message.h"
 #include "Source/santad/Metrics.h"
 
@@ -40,11 +41,18 @@
 using santa::santad::event_providers::endpoint_security::Message;
 using santa::santad::logs::endpoint_security::Logger;
 
+static NSString *const kMetricStartupDiskOperationSkip = @"Skipped";
+static NSString *const kMetricStartupDiskOperationAllowed = @"Allowed";
+static NSString *const kMetricStartupDiskOperationUnmountFailed = @"UnmountFailed";
+static NSString *const kMetricStartupDiskOperationRemountFailed = @"RemountFailed";
+static NSString *const kMetricStartupDiskOperationSuccess = @"Success";
+
 @interface SNTEndpointSecurityDeviceManager ()
 
 - (void)logDiskAppeared:(NSDictionary *)props;
 - (void)logDiskDisappeared:(NSDictionary *)props;
 
+@property SNTMetricCounter *startupDiskMetrics;
 @property DASessionRef diskArbSession;
 @property(nonatomic, readonly) dispatch_queue_t diskQueue;
 @property dispatch_semaphore_t diskSema;
@@ -182,6 +190,20 @@ - (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
     _diskArbSession = DASessionCreate(NULL);
     DASessionSetDispatchQueue(_diskArbSession, _diskQueue);
 
+    SNTMetricInt64Gauge *startupPrefsMetric = [[SNTMetricSet sharedInstance]
+      int64GaugeWithName:@"/santa/device_manager/startup_preference"
+              fieldNames:@[]
+                helpText:@"The current startup preference value"];
+
+    [[SNTMetricSet sharedInstance] registerCallback:^{
+      [startupPrefsMetric set:startupPrefs forFieldValues:@[]];
+    }];
+
+    _startupDiskMetrics = [[SNTMetricSet sharedInstance]
+      counterWithName:@"/santa/device_manager/startup_disk_operation"
+           fieldNames:@[ @"operation" ]
+             helpText:@"Count of the number of USB devices encountered per operation"];
+
     [self performStartupTasks:startupPrefs];
 
     [self establishClientOrDie];
@@ -233,6 +255,10 @@ - (BOOL)remountUSBModeContainsFlags:(uint32_t)flags {
   return (flags & requiredFlags) == requiredFlags;
 }
 
+- (void)incrementStartupMetricsOperation:(NSString *)op {
+  [self.startupDiskMetrics incrementForFieldValues:@[ op ]];
+}
+
 // NB: Remount options are implemented as separate "unmount" and "mount"
 // operations instead of using the "update"/MNT_UPDATE flag. This is because
 // filesystems often don't support many transitions (e.g. RW to RO). Performing
@@ -268,12 +294,14 @@ - (void)performStartupTasks:(SNTDeviceManagerStartupPreferences)startupPrefs {
     CFAutorelease(disk);
 
     if (![self shouldOperateOnDisk:disk]) {
+      [self incrementStartupMetricsOperation:kMetricStartupDiskOperationSkip];
       continue;
     }
 
     if (self.remountArgs != nil && [self remountUSBModeContainsFlags:sfs->f_flags]) {
       LOGI(@"Allowing existing mount as flags contain RemountUSBMode. '%s' -> '%s'",
            sfs->f_mntfromname, sfs->f_mntonname);
+      [self incrementStartupMetricsOperation:kMetricStartupDiskOperationAllowed];
       continue;
     }
 
@@ -293,6 +321,7 @@ - (void)performStartupTasks:(SNTDeviceManagerStartupPreferences)startupPrefs {
       LOGW(
         @"Unmounting '%s' mounted on '%s' took longer than expected. Device may still be mounted.",
         sfs->f_mntfromname, sfs->f_mntonname);
+      [self incrementStartupMetricsOperation:kMetricStartupDiskOperationUnmountFailed];
       continue;
     }
 
@@ -307,8 +336,12 @@ - (void)performStartupTasks:(SNTDeviceManagerStartupPreferences)startupPrefs {
       if (dispatch_semaphore_wait(self.diskSema,
                                   dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC))) {
         LOGW(@"Failed to remount device after unmounting: %s", sfs->f_mntfromname);
+        [self incrementStartupMetricsOperation:kMetricStartupDiskOperationRemountFailed];
+        continue;
       }
     }
+
+    [self incrementStartupMetricsOperation:kMetricStartupDiskOperationSuccess];
   }
 }
 

diff --git a/Source/santad/Logs/EndpointSecurity/Serializers/BasicString.mm b/Source/santad/Logs/EndpointSecurity/Serializers/BasicString.mm
@@ -37,6 +37,7 @@
 
 using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
 using santa::santad::event_providers::endpoint_security::EnrichedClose;
+using santa::santad::event_providers::endpoint_security::EnrichedCSInvalidated;
 using santa::santad::event_providers::endpoint_security::EnrichedExchange;
 using santa::santad::event_providers::endpoint_security::EnrichedExec;
 using santa::santad::event_providers::endpoint_security::EnrichedExit;
@@ -45,7 +46,6 @@
 using santa::santad::event_providers::endpoint_security::EnrichedProcess;
 using santa::santad::event_providers::endpoint_security::EnrichedRename;
 using santa::santad::event_providers::endpoint_security::EnrichedUnlink;
-using santa::santad::event_providers::endpoint_security::EnrichedCSInvalidated;
 using santa::santad::event_providers::endpoint_security::Message;
 using santa::santad::logs::endpoint_security::serializers::Utilities::MountFromName;
 using santa::santad::logs::endpoint_security::serializers::Utilities::NonNull;

diff --git a/Source/santad/Metrics.mm b/Source/santad/Metrics.mm
@@ -167,7 +167,7 @@
                      fieldNames:@[ @"Processor" ]
                        helpText:@"Events rate limited by each processor"];
 
-  SNTMetricCounter *faa_event_counts = [[SNTMetricSet sharedInstance]
+  SNTMetricCounter *faa_event_counts = [metric_set
     counterWithName:@"/santa/file_access_authorizer/log/count"
          fieldNames:@[
            @"config_version", @"access_type", @"rule_id", @"status", @"operation", @"decision"