Skip to content

refactor(metrics): improve d_instantiate dispatch metric tracking - #1455

Open
Molter73 wants to merge 1 commit into
mauro/chore/configurable-d-instantiate-ctxfrom
mauro/refactor/d-instantiate-metrics
Open

refactor(metrics): improve d_instantiate dispatch metric tracking#1455
Molter73 wants to merge 1 commit into
mauro/chore/configurable-d-instantiate-ctxfrom
mauro/refactor/d-instantiate-metrics

Conversation

@Molter73

@Molter73 Molter73 commented Aug 12, 2026

Copy link
Copy Markdown
Member

Description

Add new metrics to the d_instantiate hook that allow for tracking individual event types dispatched. This is helpful to identify if one of these types are being lost by comparing the Added label from the originating hook (like path_mkdir or path_symlink) with the corresponding Added<hook> label.

In order for d_instantiate to have its own type some trait + iterator gymnastics were necessary. The summary for this is:

  • A new KernelMetric trait is created which describes how metrics coming from the kernel should be accumulated and encoded using a KernelMetricLabel helper type.
  • The trait is implemented for metrics_by_hook_t and metrics_d_instantiate_t.
  • The metrics module know how to translate from KernelMetricLabel to LabelValues, so it does the same accumulate process it used to do and then uses the iterator produced by encode to add metrics dynamically.

Checklist

  • Patch has a change log entry OR does not need one.
  • Investigated and inspected CI test results
  • Updated documentation accordingly

Automated testing

  • Added unit tests
  • Added integration tests
  • Added regression tests

If any of these don't apply, please comment below.

Testing Performed

  • Check metrics generated in tests have the expected values.

Example metrics for d_instantiate from a mkdir test:

# HELP stackrox_fact_kernel_d_instantiate_events Events processed by the d_instantiate LSM hook.
# TYPE stackrox_fact_kernel_d_instantiate_events counter
stackrox_fact_kernel_d_instantiate_events_total{label="Total"} 15
stackrox_fact_kernel_d_instantiate_events_total{label="Added"} 3
stackrox_fact_kernel_d_instantiate_events_total{label="AddedSymlink"} 0
stackrox_fact_kernel_d_instantiate_events_total{label="Error"} 0
stackrox_fact_kernel_d_instantiate_events_total{label="AddedMkDir"} 3
stackrox_fact_kernel_d_instantiate_events_total{label="RingbufferFull"} 0
stackrox_fact_kernel_d_instantiate_events_total{label="Ignored"} 12
Full metrics from that same test
# HELP stackrox_fact_bpf_events Events processed by the BPF worker.
# TYPE stackrox_fact_bpf_events counter
stackrox_fact_bpf_events_total{label="Added"} 4
stackrox_fact_bpf_events_total{label="Dropped"} 0
stackrox_fact_bpf_events_total{label="Ignored"} 0
# HELP stackrox_fact_rate_limiter_events Events processed by the rate limiter.
# TYPE stackrox_fact_rate_limiter_events counter
stackrox_fact_rate_limiter_events_total{label="Added"} 1
stackrox_fact_rate_limiter_events_total{label="Dropped"} 0
stackrox_fact_rate_limiter_events_total{label="Error"} 0
# HELP stackrox_fact_output_stdout_events Events processed by the stdout output component.
# TYPE stackrox_fact_output_stdout_events counter
stackrox_fact_output_stdout_events_total{label="Dropped"} 0
stackrox_fact_output_stdout_events_total{label="Added"} 1
# HELP stackrox_fact_output_grpc_events Events processed by the grpc output component.
# TYPE stackrox_fact_output_grpc_events counter
stackrox_fact_output_grpc_events_total{label="Added"} 1
stackrox_fact_output_grpc_events_total{label="Dropped"} 0
# HELP stackrox_fact_output_otel_events Events processed by the otel output component.
# TYPE stackrox_fact_output_otel_events counter
stackrox_fact_output_otel_events_total{label="Added"} 0
stackrox_fact_output_otel_events_total{label="Dropped"} 0
# HELP stackrox_fact_host_scanner_events Events processed by the host scanner component.
# TYPE stackrox_fact_host_scanner_events counter
stackrox_fact_host_scanner_events_total{label="Ignored"} 0
stackrox_fact_host_scanner_events_total{label="Total"} 0
stackrox_fact_host_scanner_events_total{label="Added"} 4
stackrox_fact_host_scanner_events_total{label="Dropped"} 0
# HELP stackrox_fact_host_scanner_scan Counter of events by scans from the host scanner component.
# TYPE stackrox_fact_host_scanner_scan counter
stackrox_fact_host_scanner_scan_total{label="InodeRemoved"} 0
stackrox_fact_host_scanner_scan_total{label="DirectoryScanned"} 1
stackrox_fact_host_scanner_scan_total{label="FileUpdated"} 6
stackrox_fact_host_scanner_scan_total{label="FsItemIgnored"} 0
stackrox_fact_host_scanner_scan_total{label="ElementsScanned"} 4
stackrox_fact_host_scanner_scan_total{label="FileRemoved"} 0
stackrox_fact_host_scanner_scan_total{label="Scans"} 1
stackrox_fact_host_scanner_scan_total{label="InodeHit"} 4
stackrox_fact_host_scanner_scan_total{label="FileScanned"} 1
# HELP stackrox_fact_kernel_file_open_events Events processed by the file_open LSM hook.
# TYPE stackrox_fact_kernel_file_open_events counter
stackrox_fact_kernel_file_open_events_total{label="Ignored"} 28
stackrox_fact_kernel_file_open_events_total{label="Total"} 29
stackrox_fact_kernel_file_open_events_total{label="Added"} 1
stackrox_fact_kernel_file_open_events_total{label="Error"} 0
stackrox_fact_kernel_file_open_events_total{label="RingbufferFull"} 0
# HELP stackrox_fact_kernel_path_unlink_events Events processed by the path_unlink LSM hook.
# TYPE stackrox_fact_kernel_path_unlink_events counter
stackrox_fact_kernel_path_unlink_events_total{label="RingbufferFull"} 0
stackrox_fact_kernel_path_unlink_events_total{label="Added"} 0
stackrox_fact_kernel_path_unlink_events_total{label="Ignored"} 0
stackrox_fact_kernel_path_unlink_events_total{label="Error"} 0
stackrox_fact_kernel_path_unlink_events_total{label="Total"} 0
# HELP stackrox_fact_kernel_path_chmod_events Events processed by the path_chmod LSM hook.
# TYPE stackrox_fact_kernel_path_chmod_events counter
stackrox_fact_kernel_path_chmod_events_total{label="Error"} 0
stackrox_fact_kernel_path_chmod_events_total{label="Ignored"} 0
stackrox_fact_kernel_path_chmod_events_total{label="Added"} 0
stackrox_fact_kernel_path_chmod_events_total{label="RingbufferFull"} 0
stackrox_fact_kernel_path_chmod_events_total{label="Total"} 0
# HELP stackrox_fact_kernel_path_chown_events Events processed by the path_chown LSM hook.
# TYPE stackrox_fact_kernel_path_chown_events counter
stackrox_fact_kernel_path_chown_events_total{label="Total"} 0
stackrox_fact_kernel_path_chown_events_total{label="Error"} 0
stackrox_fact_kernel_path_chown_events_total{label="Added"} 0
stackrox_fact_kernel_path_chown_events_total{label="RingbufferFull"} 0
stackrox_fact_kernel_path_chown_events_total{label="Ignored"} 0
# HELP stackrox_fact_kernel_path_rename_events Events processed by the path_rename LSM hook.
# TYPE stackrox_fact_kernel_path_rename_events counter
stackrox_fact_kernel_path_rename_events_total{label="RingbufferFull"} 0
stackrox_fact_kernel_path_rename_events_total{label="Total"} 0
stackrox_fact_kernel_path_rename_events_total{label="Ignored"} 0
stackrox_fact_kernel_path_rename_events_total{label="Error"} 0
stackrox_fact_kernel_path_rename_events_total{label="Added"} 0
# HELP stackrox_fact_kernel_path_mkdir_events Events processed by the path_mkdir LSM hook.
# TYPE stackrox_fact_kernel_path_mkdir_events counter
stackrox_fact_kernel_path_mkdir_events_total{label="Added"} 0
stackrox_fact_kernel_path_mkdir_events_total{label="Error"} 0
stackrox_fact_kernel_path_mkdir_events_total{label="Total"} 3
stackrox_fact_kernel_path_mkdir_events_total{label="Ignored"} 0
stackrox_fact_kernel_path_mkdir_events_total{label="RingbufferFull"} 0
# HELP stackrox_fact_kernel_path_rmdir_events Events processed by the path_rmdir LSM hook.
# TYPE stackrox_fact_kernel_path_rmdir_events counter
stackrox_fact_kernel_path_rmdir_events_total{label="Total"} 0
stackrox_fact_kernel_path_rmdir_events_total{label="Added"} 0
stackrox_fact_kernel_path_rmdir_events_total{label="Error"} 0
stackrox_fact_kernel_path_rmdir_events_total{label="Ignored"} 0
stackrox_fact_kernel_path_rmdir_events_total{label="RingbufferFull"} 0
# HELP stackrox_fact_kernel_d_instantiate_events Events processed by the d_instantiate LSM hook.
# TYPE stackrox_fact_kernel_d_instantiate_events counter
stackrox_fact_kernel_d_instantiate_events_total{label="Total"} 15
stackrox_fact_kernel_d_instantiate_events_total{label="Added"} 3
stackrox_fact_kernel_d_instantiate_events_total{label="AddedSymlink"} 0
stackrox_fact_kernel_d_instantiate_events_total{label="Error"} 0
stackrox_fact_kernel_d_instantiate_events_total{label="AddedMkDir"} 3
stackrox_fact_kernel_d_instantiate_events_total{label="RingbufferFull"} 0
stackrox_fact_kernel_d_instantiate_events_total{label="Ignored"} 12
# HELP stackrox_fact_kernel_inode_setxattr_events Events processed by the inode_setxattr LSM hook.
# TYPE stackrox_fact_kernel_inode_setxattr_events counter
stackrox_fact_kernel_inode_setxattr_events_total{label="Ignored"} 0
stackrox_fact_kernel_inode_setxattr_events_total{label="Added"} 0
stackrox_fact_kernel_inode_setxattr_events_total{label="RingbufferFull"} 0
stackrox_fact_kernel_inode_setxattr_events_total{label="Total"} 0
stackrox_fact_kernel_inode_setxattr_events_total{label="Error"} 0
# HELP stackrox_fact_kernel_inode_removexattr_events Events processed by the inode_removexattr LSM hook.
# TYPE stackrox_fact_kernel_inode_removexattr_events counter
stackrox_fact_kernel_inode_removexattr_events_total{label="Error"} 0
stackrox_fact_kernel_inode_removexattr_events_total{label="Added"} 0
stackrox_fact_kernel_inode_removexattr_events_total{label="Total"} 0
stackrox_fact_kernel_inode_removexattr_events_total{label="Ignored"} 0
stackrox_fact_kernel_inode_removexattr_events_total{label="RingbufferFull"} 0
# HELP stackrox_fact_kernel_inode_set_acl_events Events processed by the inode_set_acl LSM hook.
# TYPE stackrox_fact_kernel_inode_set_acl_events counter
stackrox_fact_kernel_inode_set_acl_events_total{label="Total"} 0
stackrox_fact_kernel_inode_set_acl_events_total{label="Ignored"} 0
stackrox_fact_kernel_inode_set_acl_events_total{label="RingbufferFull"} 0
stackrox_fact_kernel_inode_set_acl_events_total{label="Added"} 0
stackrox_fact_kernel_inode_set_acl_events_total{label="Error"} 0
# HELP stackrox_fact_kernel_sb_mount_events Events processed by the sb_mount LSM hook.
# TYPE stackrox_fact_kernel_sb_mount_events counter
stackrox_fact_kernel_sb_mount_events_total{label="Total"} 0
stackrox_fact_kernel_sb_mount_events_total{label="Error"} 0
stackrox_fact_kernel_sb_mount_events_total{label="RingbufferFull"} 0
stackrox_fact_kernel_sb_mount_events_total{label="Added"} 0
stackrox_fact_kernel_sb_mount_events_total{label="Ignored"} 0
# HELP stackrox_fact_kernel_sb_umount_events Events processed by the sb_umount LSM hook.
# TYPE stackrox_fact_kernel_sb_umount_events counter
stackrox_fact_kernel_sb_umount_events_total{label="Total"} 0
stackrox_fact_kernel_sb_umount_events_total{label="Added"} 0
stackrox_fact_kernel_sb_umount_events_total{label="RingbufferFull"} 0
stackrox_fact_kernel_sb_umount_events_total{label="Error"} 0
stackrox_fact_kernel_sb_umount_events_total{label="Ignored"} 0
# HELP stackrox_fact_kernel_move_mount_events Events processed by the move_mount LSM hook.
# TYPE stackrox_fact_kernel_move_mount_events counter
stackrox_fact_kernel_move_mount_events_total{label="Total"} 0
stackrox_fact_kernel_move_mount_events_total{label="Added"} 0
stackrox_fact_kernel_move_mount_events_total{label="Ignored"} 0
stackrox_fact_kernel_move_mount_events_total{label="Error"} 0
stackrox_fact_kernel_move_mount_events_total{label="RingbufferFull"} 0
# HELP stackrox_fact_kernel_path_symlink_events Events processed by the path_symlink LSM hook.
# TYPE stackrox_fact_kernel_path_symlink_events counter
stackrox_fact_kernel_path_symlink_events_total{label="Error"} 0
stackrox_fact_kernel_path_symlink_events_total{label="Ignored"} 0
stackrox_fact_kernel_path_symlink_events_total{label="RingbufferFull"} 0
stackrox_fact_kernel_path_symlink_events_total{label="Added"} 0
stackrox_fact_kernel_path_symlink_events_total{label="Total"} 0
# EOF

Summary by CodeRabbit

  • New Features

    • Kernel metrics now report dedicated counters for directory creation and symbolic-link events.
    • Metric collection supports extensible labels, enabling more detailed event visibility.
  • Improvements

    • Kernel metric aggregation and reporting now consistently include specialized event counters.
    • Added guidance for determining whether the d_instantiate_ctx_size configuration requires adjustment.

@Molter73
Molter73 requested a review from a team as a code owner August 12, 2026 14:33
@coderabbitai

coderabbitai Bot commented Aug 12, 2026

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

The change adds dedicated mkdir and symlink counters to d_instantiate, exposes generic kernel metric encoding through a Rust trait, and updates label refresh and configuration documentation to support the expanded metrics.

Changes

Kernel metric extensions

Layer / File(s) Summary
Specialized d_instantiate counters
fact-ebpf/src/bpf/types.h, fact-ebpf/src/bpf/main.c
d_instantiate now stores base metrics with dedicated mkdir and symlink counters. The trace handler increments the corresponding counters.
Kernel metric encoding
fact-ebpf/src/lib.rs
The KernelMetric trait and KernelMetricLabel enum define aggregation and encoding. Implementations encode base metrics and d_instantiate event-specific counters.
Metric label consumption
fact/src/metrics/kernel_metrics.rs, fact/src/metrics/mod.rs, fact/src/config/mod.rs
Label refresh consumes encoded kernel metrics. Internal labels now include mkdir and symlink values. The configuration documentation references the relevant metrics.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant trace_d_instantiate
  participant KernelMetric
  participant refresh_labels
  trace_d_instantiate->>KernelMetric: provide d_instantiate metrics
  KernelMetric->>KernelMetric: encode base, mkdir, and symlink counters
  KernelMetric->>refresh_labels: return metric label/value pairs
Loading

Possibly related PRs

Suggested reviewers: stringy, joukovirtanen

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Title check ✅ Passed The title clearly and concisely describes the main change: improved d_instantiate metric tracking.
Description check ✅ Passed The description explains the change, lists checklist status, and provides concrete testing results with expected metrics.
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch mauro/refactor/d-instantiate-metrics

Comment @coderabbitai help to get the list of available commands.

@codecov-commenter

codecov-commenter commented Aug 12, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 0% with 36 lines in your changes missing coverage. Please review.
✅ Project coverage is 34.17%. Comparing base (cfc8a73) to head (956d0c0).

Files with missing lines Patch % Lines
fact-ebpf/src/lib.rs 0.00% 22 Missing ⚠️
fact/src/metrics/mod.rs 0.00% 11 Missing ⚠️
fact/src/metrics/kernel_metrics.rs 0.00% 3 Missing ⚠️
Additional details and impacted files
@@                              Coverage Diff                               @@
##           mauro/chore/configurable-d-instantiate-ctx    #1455      +/-   ##
==============================================================================
- Coverage                                       34.45%   34.17%   -0.28%     
==============================================================================
  Files                                              22       22              
  Lines                                            3373     3400      +27     
  Branches                                         3373     3400      +27     
==============================================================================
  Hits                                             1162     1162              
- Misses                                           2206     2233      +27     
  Partials                                            5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@Molter73
Molter73 force-pushed the mauro/refactor/d-instantiate-metrics branch from acc07ac to 9ea568b Compare August 12, 2026 14:46
@Molter73
Molter73 force-pushed the mauro/refactor/d-instantiate-metrics branch from 9ea568b to 158ce06 Compare August 12, 2026 16:17

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
fact-ebpf/src/lib.rs (1)

217-259: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add focused tests for the new metric contract.

Codecov reports zero patch coverage for these changes. Add tests before merge to protect counter aggregation and label encoding.

  • fact-ebpf/src/lib.rs#L217-L259: Test base and d_instantiate accumulation and all encoded label/value pairs.
  • fact/src/metrics/kernel_metrics.rs#L49-L55: Test that encoded d_instantiate labels create and update separate Prometheus counters.
  • fact/src/metrics/mod.rs#L28-L40: Test conversion of AddedMkDir and AddedSymlink to metric label values.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@fact-ebpf/src/lib.rs` around lines 217 - 259, Low test coverage leaves the
new kernel metric aggregation and encoding contract unprotected. In
fact-ebpf/src/lib.rs lines 217-259, add focused tests for metrics_by_hook_t and
metrics_d_instantiate_t accumulation and every encoded label/value pair; in
fact/src/metrics/kernel_metrics.rs lines 49-55, verify AddedMkDir and
AddedSymlink create and update separate Prometheus counters; in
fact/src/metrics/mod.rs lines 28-40, verify both labels convert to the expected
metric label values.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@fact-ebpf/src/bpf/main.c`:
- Line 367: Move the added_mkdir increment at fact-ebpf/src/bpf/main.c:367 and
the added_symlink increment at fact-ebpf/src/bpf/main.c:379 into the successful
event-emission paths of submit_mkdir_event and submit_symlink_event,
respectively, alongside base.added. Do not increment either subtype counter when
reservation or event preparation returns without emitting an event.

---

Nitpick comments:
In `@fact-ebpf/src/lib.rs`:
- Around line 217-259: Low test coverage leaves the new kernel metric
aggregation and encoding contract unprotected. In fact-ebpf/src/lib.rs lines
217-259, add focused tests for metrics_by_hook_t and metrics_d_instantiate_t
accumulation and every encoded label/value pair; in
fact/src/metrics/kernel_metrics.rs lines 49-55, verify AddedMkDir and
AddedSymlink create and update separate Prometheus counters; in
fact/src/metrics/mod.rs lines 28-40, verify both labels convert to the expected
metric label values.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Enterprise

Run ID: 421c0e08-6f7e-4c3d-8385-c11933dc3286

📥 Commits

Reviewing files that changed from the base of the PR and between cfc8a73 and 158ce06.

📒 Files selected for processing (6)
  • fact-ebpf/src/bpf/main.c
  • fact-ebpf/src/bpf/types.h
  • fact-ebpf/src/lib.rs
  • fact/src/config/mod.rs
  • fact/src/metrics/kernel_metrics.rs
  • fact/src/metrics/mod.rs

Comment thread fact-ebpf/src/bpf/main.c
Add new metrics to the d_instantiate hook that allow for tracking
individual event types dispatched. This is helpful to identify if one of
these types are being lost by comparing the `Added` label from the
originating hook (like path_mkdir or path_symlink) with the
corresponding `Added<hook>` label.

In order for `d_instantiate` to have its own type some trait + iterator
gymnastics were necessary. The summary for this is:
* A new `KernelMetric` trait is created which describes how metrics
  coming from the kernel should be accumulated and encoded using a
  `KernelMetricLabel` helper type.
* The trait is implemented for `metrics_by_hook_t` and
  `metrics_d_instantiate_t`.
* The metrics module know how to translate from `KernelMetricLabel` to
  `LabelValues`, so it does the same `accumulate` process it used to do
  and then uses the iterator produced by `encode` to add metrics
  dynamically.
@Molter73
Molter73 force-pushed the mauro/refactor/d-instantiate-metrics branch from 158ce06 to 956d0c0 Compare August 12, 2026 16:26
@JoukoVirtanen

Copy link
Copy Markdown
Contributor

Please provide sample metrics.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants