Skip to content

ROX-33352: Add histogram of lineage size #19406

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JoukoVirtanen wants to merge 3 commits into
base: jv-ROX-32873-metrics-for-process-arguments
Choose a base branch
from
+43 −1
Open

ROX-33352: Add histogram of lineage size #19406

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
99bdbc0
X-Smart-Branch-Parent: jv-ROX-32873-metrics-for-process-arguments
JoukoVirtanen Mar 13, 2026
d6cf8fc
Added a metric for lineage info
JoukoVirtanen Mar 13, 2026
3139871
There is just one histogram for central. Process lineage lengths are …
JoukoVirtanen Mar 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 43 additions & 1 deletion central/processindicator/datastore/metrics.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,21 @@ var (
Name: "process_upserted_args_size_total",
Help: "Total process argument sizes in characters by cluster and namespace",
}, []string{"cluster", "namespace"})

processIndicatorsLineageSizeHistogram = prometheus.NewHistogram(prometheus.HistogramOpts{
Namespace: metrics.PrometheusNamespace,
Subsystem: metrics.CentralSubsystem.String(),
Name: "process_indicators_lineage_size",
Help: "Distribution of process lineage sizes in characters for upserted indicators",
Buckets: []float64{0, 128, 256, 512, 1024, 2048, 4096, 8192, 16384, 32768, 65536},
})

processIndicatorsLineageSizeTotal = prometheus.NewCounterVec(prometheus.CounterOpts{
Namespace: metrics.PrometheusNamespace,
Subsystem: metrics.CentralSubsystem.String(),
Name: "process_indicators_lineage_size_total",
Help: "Total process lineage sizes in characters by cluster and namespace",
}, []string{"cluster", "namespace"})
)

func incrementPrunedProcessesMetric(num int) {
Expand All @@ -67,16 +82,41 @@ func getProcessArgsSizeChars(indicator *storage.ProcessIndicator) int {
return utf8.RuneCountInString(indicator.GetSignal().GetArgs())
}

// getProcessLineageSizeChars safely calculates the total size of process lineage in characters (runes).
// Returns 0 if signal or lineage are nil/empty.
func getProcessLineageSizeChars(indicator *storage.ProcessIndicator) int {
if indicator == nil || indicator.GetSignal() == nil {
return 0
}

lineageInfo := indicator.GetSignal().GetLineageInfo()
if len(lineageInfo) == 0 {
return 0
}

totalChars := 0
for _, info := range lineageInfo {
if info != nil {
totalChars += utf8.RuneCountInString(info.GetParentExecFilePath())
}
}

return totalChars
}

// recordProcessIndicatorsBatchAdded records metrics for a batch of process indicators successfully written to DB.
func recordProcessIndicatorsBatchAdded(indicators []*storage.ProcessIndicator) {
for _, indicator := range indicators {
argsSizeChars := getProcessArgsSizeChars(indicator)
lineageSizeChars := getProcessLineageSizeChars(indicator)
clusterID := indicator.GetClusterId()
namespace := indicator.GetNamespace()

processUpsertedArgsSizeHistogram.Observe(float64(argsSizeChars))

processUpsertedArgsSizeTotal.WithLabelValues(clusterID, namespace).Add(float64(argsSizeChars))

processIndicatorsLineageSizeHistogram.Observe(float64(lineageSizeChars))
processIndicatorsLineageSizeTotal.WithLabelValues(clusterID, namespace).Add(float64(lineageSizeChars))
}
}

Expand All @@ -87,5 +127,7 @@ func init() {
processPruningCacheMisses,
processUpsertedArgsSizeHistogram,
processUpsertedArgsSizeTotal,
processIndicatorsLineageSizeHistogram,
processIndicatorsLineageSizeTotal,
)
}
Loading