diff --git a/central/processindicator/datastore/metrics.go b/central/processindicator/datastore/metrics.go index 958b1f178db1a..e7977611ac718 100644 --- a/central/processindicator/datastore/metrics.go +++ b/central/processindicator/datastore/metrics.go @@ -44,6 +44,21 @@ var ( Name: "process_upserted_args_size_total", Help: "Total process argument sizes in characters by cluster and namespace", }, []string{"cluster", "namespace"}) + + processIndicatorsLineageSizeHistogram = prometheus.NewHistogram(prometheus.HistogramOpts{ + Namespace: metrics.PrometheusNamespace, + Subsystem: metrics.CentralSubsystem.String(), + Name: "process_indicators_lineage_size", + Help: "Distribution of process lineage sizes in characters for upserted indicators", + Buckets: []float64{0, 128, 256, 512, 1024, 2048, 4096, 8192, 16384, 32768, 65536}, + }) + + processIndicatorsLineageSizeTotal = prometheus.NewCounterVec(prometheus.CounterOpts{ + Namespace: metrics.PrometheusNamespace, + Subsystem: metrics.CentralSubsystem.String(), + Name: "process_indicators_lineage_size_total", + Help: "Total process lineage sizes in characters by cluster and namespace", + }, []string{"cluster", "namespace"}) ) func incrementPrunedProcessesMetric(num int) { @@ -67,16 +82,41 @@ func getProcessArgsSizeChars(indicator *storage.ProcessIndicator) int { return utf8.RuneCountInString(indicator.GetSignal().GetArgs()) } +// getProcessLineageSizeChars safely calculates the total size of process lineage in characters (runes). +// Returns 0 if signal or lineage are nil/empty. +func getProcessLineageSizeChars(indicator *storage.ProcessIndicator) int { + if indicator == nil || indicator.GetSignal() == nil { + return 0 + } + + lineageInfo := indicator.GetSignal().GetLineageInfo() + if len(lineageInfo) == 0 { + return 0 + } + + totalChars := 0 + for _, info := range lineageInfo { + if info != nil { + totalChars += utf8.RuneCountInString(info.GetParentExecFilePath()) + } + } + + return totalChars +} + // recordProcessIndicatorsBatchAdded records metrics for a batch of process indicators successfully written to DB. func recordProcessIndicatorsBatchAdded(indicators []*storage.ProcessIndicator) { for _, indicator := range indicators { argsSizeChars := getProcessArgsSizeChars(indicator) + lineageSizeChars := getProcessLineageSizeChars(indicator) clusterID := indicator.GetClusterId() namespace := indicator.GetNamespace() processUpsertedArgsSizeHistogram.Observe(float64(argsSizeChars)) - processUpsertedArgsSizeTotal.WithLabelValues(clusterID, namespace).Add(float64(argsSizeChars)) + + processIndicatorsLineageSizeHistogram.Observe(float64(lineageSizeChars)) + processIndicatorsLineageSizeTotal.WithLabelValues(clusterID, namespace).Add(float64(lineageSizeChars)) } } @@ -87,5 +127,7 @@ func init() { processPruningCacheMisses, processUpsertedArgsSizeHistogram, processUpsertedArgsSizeTotal, + processIndicatorsLineageSizeHistogram, + processIndicatorsLineageSizeTotal, ) }