From ad8b47b9f32422b21e7cf7840ec94700994778f4 Mon Sep 17 00:00:00 2001 From: Benjamin Kilimnik Date: Wed, 14 Feb 2024 18:00:24 +0000 Subject: [PATCH] change EBPFSERVER marchingmode to ALL, rebase Signed-off-by: Benjamin Kilimnik --- entity-types/ebpf-client/definition.yml | 16 ++++++ entity-types/ebpf-client/tests/Span.json | 11 ++++ entity-types/ebpf-redis_server/definition.yml | 24 +++++++++ .../ebpf-redis_server/tests/Span.json | 11 ++++ relationships/candidates/EBPFCLIENT.yml | 16 ++++++ relationships/candidates/EBPFSERVER.yml | 18 +++++++ .../synthesis/EBPF-CLIENT-to-EBPF_REDIS.yml | 52 +++++++++++++++++++ 7 files changed, 148 insertions(+) create mode 100644 entity-types/ebpf-client/definition.yml create mode 100644 entity-types/ebpf-client/tests/Span.json create mode 100644 entity-types/ebpf-redis_server/definition.yml create mode 100644 entity-types/ebpf-redis_server/tests/Span.json create mode 100644 relationships/candidates/EBPFCLIENT.yml create mode 100644 relationships/candidates/EBPFSERVER.yml create mode 100644 relationships/synthesis/EBPF-CLIENT-to-EBPF_REDIS.yml diff --git a/entity-types/ebpf-client/definition.yml b/entity-types/ebpf-client/definition.yml new file mode 100644 index 000000000..f10cb45e7 --- /dev/null +++ b/entity-types/ebpf-client/definition.yml @@ -0,0 +1,16 @@ +domain: EBPF +type: CLIENT +synthesis: + rules: + # Client Entity for Client-Captured Spans (kind == client) + - name: local_addr + identifier: local_addr + encodeIdentifierInGUID: true + conditions: + - attribute: instrumentation.provider + value: nr_ebpf_agent + - attribute: kind + value: "client" + tags: + local_addr: + entityTagName: "ip" \ No newline at end of file diff --git a/entity-types/ebpf-client/tests/Span.json b/entity-types/ebpf-client/tests/Span.json new file mode 100644 index 000000000..c2e8e7a56 --- /dev/null +++ b/entity-types/ebpf-client/tests/Span.json @@ -0,0 +1,11 @@ +[ + { + "redis.req_cmd": "HMGET", + "instrumentation.provider": "nr_ebpf_agent", + "kind": "client", + "local_addr": "192.xxx.x.xx", + "local_port": "92" , + "remote_addr": "198.xxx.x.xx", + "remote_port": "98" + } +] \ No newline at end of file diff --git a/entity-types/ebpf-redis_server/definition.yml b/entity-types/ebpf-redis_server/definition.yml new file mode 100644 index 000000000..ce9ea6c0c --- /dev/null +++ b/entity-types/ebpf-redis_server/definition.yml @@ -0,0 +1,24 @@ +domain: EBPF +type: REDIS_SERVER +synthesis: + rules: + # Server Entity for Server-Captured Spans (kind == server) + - compositeIdentifier: + separator: ":" + attributes: + - local_addr + - local_port + name: local_addr + encodeIdentifierInGUID: true + conditions: + - attribute: redis.req_cmd + present: true + - attribute: instrumentation.provider + value: "nr_ebpf_agent" + - attribute: kind + value: "server" + tags: + local_addr: + entityTagName: "ip" + local_port: + entityTagName: "port" \ No newline at end of file diff --git a/entity-types/ebpf-redis_server/tests/Span.json b/entity-types/ebpf-redis_server/tests/Span.json new file mode 100644 index 000000000..112bf8b0a --- /dev/null +++ b/entity-types/ebpf-redis_server/tests/Span.json @@ -0,0 +1,11 @@ +[ + { + "redis.req_cmd": "HMGET", + "instrumentation.provider": "nr_ebpf_agent", + "kind": "server", + "local_addr": "198.xxx.x.xx", + "local_port": "98", + "remote_addr": "192.xxx.x.xx", + "remote_port": "92" + } +] \ No newline at end of file diff --git a/relationships/candidates/EBPFCLIENT.yml b/relationships/candidates/EBPFCLIENT.yml new file mode 100644 index 000000000..b8304383f --- /dev/null +++ b/relationships/candidates/EBPFCLIENT.yml @@ -0,0 +1,16 @@ +category: EBPFCLIENT +lookups: + - entityTypes: + - domain: EBPF + type: CLIENT + tags: + matchingMode: ANY + predicates: + - tagKeys: ["ip"] + field: ip + onMatch: + onMultipleMatches: RELATE_ALL + onMiss: + action: CREATE_UNINSTRUMENTED + uninstrumented: + type: EBPFCLIENT \ No newline at end of file diff --git a/relationships/candidates/EBPFSERVER.yml b/relationships/candidates/EBPFSERVER.yml new file mode 100644 index 000000000..3aa50540b --- /dev/null +++ b/relationships/candidates/EBPFSERVER.yml @@ -0,0 +1,18 @@ +category: EBPFSERVER +lookups: + - entityTypes: + - domain: EBPF + type: REDIS_SERVER + tags: + matchingMode: ALL + predicates: + - tagKeys: ["ip"] + field: ip + - tagKeys: ["port"] + field: port + onMatch: + onMultipleMatches: RELATE_ALL + onMiss: + action: CREATE_UNINSTRUMENTED + uninstrumented: + type: EBPFSERVER \ No newline at end of file diff --git a/relationships/synthesis/EBPF-CLIENT-to-EBPF_REDIS.yml b/relationships/synthesis/EBPF-CLIENT-to-EBPF_REDIS.yml new file mode 100644 index 000000000..51a458cfd --- /dev/null +++ b/relationships/synthesis/EBPF-CLIENT-to-EBPF_REDIS.yml @@ -0,0 +1,52 @@ +relationships: + - name: clientCallsRedisServerFromServerSpan + version: "1" + origins: + - Distributed Tracing + conditions: + - attribute: eventType + anyOf: [ "Span" ] + - attribute: entity.type + anyOf: [ "REDIS_SERVER" ] + - attribute: kind + value: "server" + relationship: + expires: P75M + relationshipType: CALLS + source: + lookupGuid: + candidateCategory: EBPFCLIENT + fields: + - field: ip + attribute: remote_addr # clientIP from server's perspective + target: + extractGuid: + attribute: entity.guid + + - name: clientCallsRedisServerFromClientSpan + version: "1" + origins: + - Distributed Tracing + conditions: + - attribute: eventType + anyOf: [ "Span" ] + - attribute: entity.type + anyOf: [ "EBPF_CLIENT" ] + - attribute: kind + value: "client" + - attribute: redis.req_cmd + present: true + relationship: + expires: P75M + relationshipType: CALLS + source: + extractGuid: + attribute: entity.guid + target: + lookupGuid: + candidateCategory: EBPFSERVER + fields: + - field: ip + attribute: remote_addr # serverIP from client's perspective + - field: port + attribute: remote_port # serverPort from client's perspective \ No newline at end of file