Entity relationship synthesis with the `New Relic eBPF agent` #1421

benkilimnik · 2024-01-23T19:33:55Z

Relevant information

This PR provides initial prototype entity definitions for the eBPF agent.

Main ideas:

Construct guid from self information, e.g. the “local” IP addr., port, and pid.
Enable relationship synthesis from tags that include local IP addr. and port, i.e. because those columns will be available as “remote IP addr. & port”

Note that in the agent, one span represents both a request and response. Currently, we cannot create two entities from a single span with NR synthesis rules. We can, however, trace a span from the client’s perspective and from the server’s point of view, as long as the ebpf agent is deployed on all hosts. Thus for entity and relationship synthesis, we can connect these two spans, one client-side and one server-side. If one side of the connection is missing, we create an uninstrumented entity for it. Ideally, we'd want to create both entities from one span, but we cannot have two rules that match the same thing with current NR entity synthesis rules.

In the current prototype, we create a `server` entity from the server-captured span, and a `client` entity from the client-captured span.

Cases:

1. Both client and server-side spans present

%%{init: {'mirrorActors': true, 'height':38, 'width': 35}}%%
flowchart TD
    C[Server-side Span] -->|Definition rule| D(Server entity)
    A[Client-side Span] -->|Definition rule| B(Client entity)
    D -->|remoteIP = clientIP| E[Relationship Synthesis]
    B <--> |lookup via ClientIP| E

Note that the direction of the connection is arbitrary, we could flip it and see the same result.

Likewise, if the client and server are on the same host, the ebpf agent will still provide two spans.

2. Span missing on the client-side

If we fail to capture a client-side span because, for instance, there is no ebpf agent deployed on that host, then we create a server entity from the server-side span, and an uninstrumented entity for the client.

%%{init: {'mirrorActors': true, 'height':38, 'width': 35}}%%
flowchart TD
    C[Server-side Span] -->|Definition rule| D(Server entity)
    D -->|remoteIP = clientIP| E[Relationship Synthesis]
    B[Uninstrumented client entity] <--> |lookup via ClientIP| E

3. Span missing on the server-side

If the server-side span is missing, then we create a client entity from the client-side span, and an uninstrumented entity for the server.

%%{init: {'mirrorActors': true, 'height':38, 'width': 35}}%%
flowchart TD
    C[Client-side Span] -->|Definition rule| D(Client entity)
    D -->|remoteIP = serverIP, remotePort = serverPort| E[Relationship Synthesis]
    B[Uninstrumented server entity] <--> |lookup via serverIP, serverPort| E

Checklist

I've read the guidelines and understand the acceptance criteria.
The value of the attribute marked as identifier will be unique and valid.
I've confirmed that my entity type wasn't already defined. If it is I'm providing an explanation above.

CLAassistant · 2024-01-23T19:34:01Z

All committers have signed the CLA.

entity-types/ebpf-client/definition.yml

entity-types/ebpf-redis_server/definition.yml

relationships/synthesis/EBPF-CLIENT-to-EBPF_REDIS.yml

entityBot