Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes for SQL detection and Go events handled by kprobes #901

Merged
merged 5 commits into from
Jun 4, 2024

Conversation

grcevski
Copy link
Contributor

@grcevski grcevski commented Jun 3, 2024

This PR fixes a few things:

  1. The SQL parsing was too naive, now we attempt to extract the operation and table name before we decide we have a SQL statement.
  2. We had a long standing issue with PID removal. Once a process terminates we'd remove the PID with our BlockPID API, but it would always fail, since the API was trying to determine the namespace in the PID filter code. This was never going to work, since at the time the /proc/ directory doesn't exist anymore. I changed the code to take the namespace as argument, which is known to us when we attach to a process.
  3. Since the PID filter at eBPF time is now a bloom filter, to avoid collisions and losing processes, we could theoretically process events generated by Go by the kprobes. There could be bloom filter space collision and the PID can match. This will cause us to generate event from kprobes that's already handled by Go, which will not be filtered out, since the PID is actually valid. I added code to detect that kprobes see an event that was meant for kprobes.

Fixes #897

@grcevski grcevski requested review from mariomac and marctc as code owners June 3, 2024 23:36
@codecov-commenter
Copy link

codecov-commenter commented Jun 3, 2024

Codecov Report

Attention: Patch coverage is 88.41463% with 19 lines in your changes missing coverage. Please review.

Project coverage is 77.90%. Comparing base (ef47785) to head (0099d44).
Report is 1 commits behind head on main.

Files Patch % Lines
pkg/internal/ebpf/common/http2grpc_transform.go 61.53% 3 Missing and 2 partials ⚠️
pkg/internal/ebpf/gokafka/gokafka.go 0.00% 4 Missing ⚠️
pkg/internal/ebpf/common/httpfltr_transform.go 33.33% 1 Missing and 1 partial ⚠️
pkg/internal/ebpf/common/pids.go 88.23% 2 Missing ⚠️
pkg/internal/ebpf/common/tcp_detect_transform.go 66.66% 1 Missing and 1 partial ⚠️
pkg/internal/ebpf/goredis/goredis.go 50.00% 2 Missing ⚠️
pkg/internal/exec/file.go 50.00% 1 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main     #901      +/-   ##
==========================================
- Coverage   77.98%   77.90%   -0.09%     
==========================================
  Files         125      126       +1     
  Lines        9124     9136      +12     
==========================================
+ Hits         7115     7117       +2     
- Misses       1544     1549       +5     
- Partials      465      470       +5     
Flag Coverage Δ
integration-test 54.15% <44.51%> (+0.26%) ⬆️
k8s-integration-test 58.77% <29.87%> (-0.26%) ⬇️
oats-test 36.97% <73.78%> (+0.03%) ⬆️
unittests 43.68% <56.09%> (-0.05%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copy link
Contributor

@mariomac mariomac left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good!

@grcevski grcevski merged commit 50e3d6e into grafana:main Jun 4, 2024
6 checks passed
@grcevski grcevski deleted the fix_sql_detect branch June 4, 2024 22:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

beyla is mistakenly detecting sql span for web calls
3 participants