Skip to content

Commit 0a4271f

Browse files
ldegioldegio
committed
a couple more span time filter fields
1 parent 01440de commit 0a4271f

File tree

2 files changed

+88
-77
lines changed

2 files changed

+88
-77
lines changed

‎userspace/libsinsp/filterchecks.cpp‎

Lines changed: 83 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,77 @@ along with sysdig. If not, see <http://www.gnu.org/licenses/>.
3333
extern sinsp_evttables g_infotables;
3434
int32_t g_csysdig_screen_w = -1;
3535

36+
///////////////////////////////////////////////////////////////////////////////
37+
// Helper functions
38+
///////////////////////////////////////////////////////////////////////////////
39+
int32_t gmt2local(time_t t)
40+
{
41+
int dt, dir;
42+
struct tm *gmt, *loc;
43+
struct tm sgmt;
44+
45+
if(t == 0)
46+
{
47+
t = time(NULL);
48+
}
49+
50+
gmt = &sgmt;
51+
*gmt = *gmtime(&t);
52+
loc = localtime(&t);
53+
54+
dt = (loc->tm_hour - gmt->tm_hour) * 60 * 60 + (loc->tm_min - gmt->tm_min) * 60;
55+
56+
dir = loc->tm_year - gmt->tm_year;
57+
if(dir == 0)
58+
{
59+
dir = loc->tm_yday - gmt->tm_yday;
60+
}
61+
62+
dt += dir * 24 * 60 * 60;
63+
64+
return dt;
65+
}
66+
67+
void ts_to_string(uint64_t ts, OUT string* res, bool date, bool ns)
68+
{
69+
struct tm *tm;
70+
time_t Time;
71+
uint64_t sec = ts / ONE_SECOND_IN_NS;
72+
uint64_t nsec = ts % ONE_SECOND_IN_NS;
73+
int32_t thiszone = gmt2local(0);
74+
int32_t s = (sec + thiszone) % 86400;
75+
int32_t bufsize = 0;
76+
char buf[256];
77+
78+
if(date)
79+
{
80+
Time = (sec + thiszone) - s;
81+
tm = gmtime (&Time);
82+
if(!tm)
83+
{
84+
bufsize = sprintf(buf, "<date error> ");
85+
}
86+
else
87+
{
88+
bufsize = sprintf(buf, "%04d-%02d-%02d ",
89+
tm->tm_year+1900, tm->tm_mon+1, tm->tm_mday);
90+
}
91+
}
92+
93+
if(ns)
94+
{
95+
sprintf(buf + bufsize, "%02d:%02d:%02d.%09u",
96+
s / 3600, (s % 3600) / 60, s % 60, (unsigned)nsec);
97+
}
98+
else
99+
{
100+
sprintf(buf + bufsize, "%02d:%02d:%02d",
101+
s / 3600, (s % 3600) / 60, s % 60);
102+
}
103+
104+
*res = buf;
105+
}
106+
36107
///////////////////////////////////////////////////////////////////////////////
37108
// sinsp_filter_check_fd implementation
38109
///////////////////////////////////////////////////////////////////////////////
@@ -2418,74 +2489,6 @@ const filtercheck_field_info* sinsp_filter_check_event::get_field_info()
24182489
}
24192490
}
24202491

2421-
int32_t sinsp_filter_check_event::gmt2local(time_t t)
2422-
{
2423-
int dt, dir;
2424-
struct tm *gmt, *loc;
2425-
struct tm sgmt;
2426-
2427-
if(t == 0)
2428-
{
2429-
t = time(NULL);
2430-
}
2431-
2432-
gmt = &sgmt;
2433-
*gmt = *gmtime(&t);
2434-
loc = localtime(&t);
2435-
2436-
dt = (loc->tm_hour - gmt->tm_hour) * 60 * 60 + (loc->tm_min - gmt->tm_min) * 60;
2437-
2438-
dir = loc->tm_year - gmt->tm_year;
2439-
if(dir == 0)
2440-
{
2441-
dir = loc->tm_yday - gmt->tm_yday;
2442-
}
2443-
2444-
dt += dir * 24 * 60 * 60;
2445-
2446-
return dt;
2447-
}
2448-
2449-
void sinsp_filter_check_event::ts_to_string(uint64_t ts, OUT string* res, bool date, bool ns)
2450-
{
2451-
struct tm *tm;
2452-
time_t Time;
2453-
uint64_t sec = ts / ONE_SECOND_IN_NS;
2454-
uint64_t nsec = ts % ONE_SECOND_IN_NS;
2455-
int32_t thiszone = gmt2local(0);
2456-
int32_t s = (sec + thiszone) % 86400;
2457-
int32_t bufsize = 0;
2458-
char buf[256];
2459-
2460-
if(date)
2461-
{
2462-
Time = (sec + thiszone) - s;
2463-
tm = gmtime (&Time);
2464-
if(!tm)
2465-
{
2466-
bufsize = sprintf(buf, "<date error> ");
2467-
}
2468-
else
2469-
{
2470-
bufsize = sprintf(buf, "%04d-%02d-%02d ",
2471-
tm->tm_year+1900, tm->tm_mon+1, tm->tm_mday);
2472-
}
2473-
}
2474-
2475-
if(ns)
2476-
{
2477-
sprintf(buf + bufsize, "%02d:%02d:%02d.%09u",
2478-
s / 3600, (s % 3600) / 60, s % 60, (unsigned)nsec);
2479-
}
2480-
else
2481-
{
2482-
sprintf(buf + bufsize, "%02d:%02d:%02d",
2483-
s / 3600, (s % 3600) / 60, s % 60);
2484-
}
2485-
2486-
*res = buf;
2487-
}
2488-
24892492
uint8_t* extract_argraw(sinsp_evt *evt, OUT uint32_t* len, const char *argname)
24902493
{
24912494
const sinsp_evt_param* pi = evt->get_param_value_raw(argname);
@@ -3905,6 +3908,7 @@ uint8_t* sinsp_filter_check_group::extract(sinsp_evt *evt, OUT uint32_t* len)
39053908
const filtercheck_field_info sinsp_filter_check_tracer_fields[] =
39063909
{
39073910
{PT_INT64, EPF_NONE, PF_ID, "span.id", "tracer ID. This is a unique identifier that is used to match the enter and exit tracer events for this span. It can also be used to match different spans belonging to a trace."},
3911+
{PT_CHARBUF, EPF_NONE, PF_NA, "span.time", "time of the span enter tracer as a time string that includes the nanosecond part."},
39083912
{PT_UINT32, EPF_NONE, PF_DEC, "span.ntags", "number of tags that this span has."},
39093913
{PT_UINT32, EPF_NONE, PF_DEC, "span.nargs", "number of arguments that this span has."},
39103914
{PT_CHARBUF, EPF_NONE, PF_NA, "span.tags", "dot-separated list of the span's tags."},
@@ -3921,8 +3925,8 @@ const filtercheck_field_info sinsp_filter_check_tracer_fields[] =
39213925
{PT_UINT64, EPF_TABLE_ONLY, PF_DEC, "span.count.fortag", "1 if the span's number of tags matches the field argument, and zero for all the other ones."},
39223926
{PT_UINT64, EPF_TABLE_ONLY, PF_DEC, "span.childcount.fortag", "1 if the span's number of tags is greater than the field argument, and zero for all the other ones."},
39233927
{PT_CHARBUF, EPF_TABLE_ONLY, PF_NA, "span.idtag", "id used by the span list csysdig view."},
3924-
{PT_CHARBUF, EPF_TABLE_ONLY, PF_NA, "span.time", "id used by the span list csysdig view."},
3925-
{PT_CHARBUF, EPF_TABLE_ONLY, PF_NA, "span.parenttime", "id used by the span list csysdig view."},
3928+
{PT_CHARBUF, EPF_TABLE_ONLY, PF_NA, "span.rawtime", "id used by the span list csysdig view."},
3929+
{PT_CHARBUF, EPF_TABLE_ONLY, PF_NA, "span.rawparenttime", "id used by the span list csysdig view."},
39263930
};
39273931

39283932
sinsp_filter_check_tracer::sinsp_filter_check_tracer()
@@ -4073,7 +4077,8 @@ int32_t sinsp_filter_check_tracer::parse_field_name(const char* str, bool alloc_
40734077
m_field_id == TYPE_ENTERARGS ||
40744078
m_field_id == TYPE_IDTAG ||
40754079
m_field_id == TYPE_TIME ||
4076-
m_field_id == TYPE_PARENTTIME
4080+
m_field_id == TYPE_RAWTIME ||
4081+
m_field_id == TYPE_RAWPARENTTIME
40774082
)
40784083
{
40794084
m_inspector->request_tracer_state_tracking();
@@ -4237,6 +4242,11 @@ uint8_t* sinsp_filter_check_tracer::extract(sinsp_evt *evt, OUT uint32_t* len)
42374242
{
42384243
case TYPE_ID:
42394244
return (uint8_t*)&eparser->m_id;
4245+
case TYPE_TIME:
4246+
{
4247+
ts_to_string(evt->get_ts(), &m_strstorage, false, true);
4248+
return (uint8_t*)m_strstorage.c_str();
4249+
}
42404250
case TYPE_NTAGS:
42414251
m_u32val = (uint32_t)eparser->m_tags.size();
42424252
return (uint8_t*)&m_u32val;
@@ -4443,12 +4453,12 @@ uint8_t* sinsp_filter_check_tracer::extract(sinsp_evt *evt, OUT uint32_t* len)
44434453
}
44444454

44454455
return (uint8_t*)&m_s64val;
4446-
case TYPE_TIME:
4456+
case TYPE_RAWTIME:
44474457
{
44484458
m_strstorage = to_string(eparser->m_enter_pae->m_time);
44494459
return (uint8_t*)m_strstorage.c_str();
44504460
}
4451-
case TYPE_PARENTTIME:
4461+
case TYPE_RAWPARENTTIME:
44524462
{
44534463
sinsp_partial_tracer* pepae = eparser->find_parent_enter_pae();
44544464

‎userspace/libsinsp/filterchecks.h‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@ bool flt_compare_avg(cmpop op, ppm_param_type type, void* operand1, void* operan
3030
bool flt_compare_ipv4net(cmpop op, uint64_t operand1, ipv4net* operand2);
3131

3232
char* flt_to_string(uint8_t* rawval, filtercheck_field_info* finfo);
33+
int32_t gmt2local(time_t t);
34+
void ts_to_string(uint64_t ts, OUT string* res, bool full, bool ns);
3335

3436
class operand_info
3537
{
@@ -479,8 +481,6 @@ class sinsp_filter_check_event : public sinsp_filter_check
479481
int32_t extract_arg(string fldname, string val, OUT const struct ppm_param_info** parinfo);
480482
int32_t extract_type(string fldname, string val, OUT const struct ppm_param_info** parinfo);
481483
uint8_t* extract_error_count(sinsp_evt *evt, OUT uint32_t* len);
482-
int32_t gmt2local(time_t t);
483-
void ts_to_string(uint64_t ts, OUT string* res, bool full, bool ns);
484484
uint8_t *extract_abspath(sinsp_evt *evt, OUT uint32_t *len);
485485
inline uint8_t* extract_buflen(sinsp_evt *evt);
486486

@@ -544,6 +544,7 @@ class sinsp_filter_check_tracer : public sinsp_filter_check
544544
enum check_type
545545
{
546546
TYPE_ID = 0,
547+
TYPE_TIME,
547548
TYPE_NTAGS,
548549
TYPE_NARGS,
549550
TYPE_TAGS,
@@ -560,8 +561,8 @@ class sinsp_filter_check_tracer : public sinsp_filter_check
560561
TYPE_TAGCOUNT,
561562
TYPE_TAGCHILDSCOUNT,
562563
TYPE_IDTAG,
563-
TYPE_TIME,
564-
TYPE_PARENTTIME,
564+
TYPE_RAWTIME,
565+
TYPE_RAWPARENTTIME,
565566
};
566567

567568
sinsp_filter_check_tracer();

0 commit comments

Comments
 (0)