feat: include ancestors in process events #2938
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes 2420
Description
Reason: Option to include all ancestors of the process in process events can be very useful for observability and filtering purposes. E.g. to apply complex correlation rules later in data processing pipeline, or to filter out extra events.
Changes made:
enable-process-ancestors
from the config file. Turn optionenable-process-ancestors
off by default.enable-process-ancestors
is set, try to include ancestors (up to PID 1/PID 2) of the process beyond the immediate parent inprocess_exec
,process_exit
,process_uprobe
,process_kprobe
,process_lsm
,process_tracepoint
events in a respective protobuf message for the given process.enable-process-ancestors
is set and there was an error when trying to include process' ancestors in the protobuf message, add the event to eventcache for reprocessing.enable-process-ancestors
is set andAncestors
is nil, try to include process' ancestors again.