Skip to content

Commit b8d4ab2

Browse files
Fix review comments: Enable eBPF as supplemental cache for json-enricher
1 parent 78edc1f commit b8d4ab2

File tree

2 files changed

+18
-12
lines changed

2 files changed

+18
-12
lines changed

internal/pkg/daemon/bpfrecorder/bpfprocesscache.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
// +build linux,!no_bpf
33

44
/*
5-
Copyright 2021 The Kubernetes Authors.
5+
Copyright 2025 The Kubernetes Authors.
66
77
Licensed under the Apache License, Version 2.0 (the "License");
88
you may not use this file except in compliance with the License.

internal/pkg/daemon/enricher/jsonenricher.go

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -254,9 +254,8 @@ func (e *JsonEnricher) Run(ctx context.Context, runErr chan<- error) {
254254

255255
bpfProcCache := bpfrecorder.NewBpfProcessCache(e.logger)
256256

257-
errBpf := bpfProcCache.Load()
258-
if errBpf != nil {
259-
e.logger.Info("Unable to load BPF module. Using auditd", "err", errBpf.Error())
257+
if err := bpfProcCache.Load(); err != nil {
258+
e.logger.Info("Unable to load BPF module. Using auditd", "err", err.Error())
260259
} else {
261260
e.bpfProcessCache = bpfProcCache
262261
}
@@ -346,23 +345,30 @@ func (e *JsonEnricher) processEbpf(logBucket *types.LogBucket, auditLine *types.
346345
if errCmdLine == nil {
347346
logBucket.ProcessInfo.CmdLine = cmdLine
348347

349-
e.logger.V(1).Info("cmd line found in eBPF")
348+
e.logger.V(1).Info("cmdline found in eBPF",
349+
"processId", auditLine.ProcessID, "cmdLine", cmdLine)
350350
} else {
351-
e.logger.V(1).Info("cmd line not found in eBPF also")
351+
e.logger.V(1).Info("cmdline not found in eBPF also",
352+
"processId", auditLine.ProcessID)
352353
}
353354
}
354355

355356
if e.bpfProcessCache != nil && logBucket.ProcessInfo != nil && logBucket.ProcessInfo.ExecRequestId == nil {
356-
procEnv, errCmdLine := e.bpfProcessCache.GetEnv(auditLine.ProcessID)
357-
if errCmdLine == nil {
357+
procEnv, errEnv := e.bpfProcessCache.GetEnv(auditLine.ProcessID)
358+
if errEnv == nil {
358359
reqId, ok := procEnv[requestIdEnv]
359-
if ok {
360+
if !ok {
361+
e.logger.V(1).Info("exec request id info not found in eBPF also",
362+
"processId", auditLine.ProcessID)
363+
} else {
360364
logBucket.ProcessInfo.ExecRequestId = &reqId
361365

362-
e.logger.V(1).Info("Exec request id info found in eBPF")
363-
} else {
364-
e.logger.V(1).Info("Exec request id info not found in eBPF also")
366+
e.logger.V(1).Info("exec request id info found in eBPF", "reqId", reqId,
367+
"processId", auditLine.ProcessID)
365368
}
369+
} else {
370+
e.logger.V(1).Error(errEnv, "fetching exec request id",
371+
"processId", auditLine.ProcessID)
366372
}
367373
}
368374
}

0 commit comments

Comments
 (0)