From 99bdbc09879ac5b4156d5f5a99de224f72e630c6 Mon Sep 17 00:00:00 2001 From: JoukoVirtanen Date: Fri, 13 Mar 2026 10:28:36 -0700 Subject: [PATCH 1/3] X-Smart-Branch-Parent: jv-ROX-32873-metrics-for-process-arguments From d6cf8fc6905a6229581ae1ec5a3e8da23cd52e94 Mon Sep 17 00:00:00 2001 From: JoukoVirtanen Date: Thu, 12 Mar 2026 17:16:26 -0700 Subject: [PATCH 2/3] Added a metric for lineage info --- central/processindicator/datastore/metrics.go | 35 +++++++++++++++++-- 1 file changed, 33 insertions(+), 2 deletions(-) diff --git a/central/processindicator/datastore/metrics.go b/central/processindicator/datastore/metrics.go index 958b1f178db1a..8b95c282b9742 100644 --- a/central/processindicator/datastore/metrics.go +++ b/central/processindicator/datastore/metrics.go @@ -44,6 +44,14 @@ var ( Name: "process_upserted_args_size_total", Help: "Total process argument sizes in characters by cluster and namespace", }, []string{"cluster", "namespace"}) + + processIndicatorsLineageSizeHistogram = prometheus.NewHistogramVec(prometheus.HistogramOpts{ + Namespace: metrics.PrometheusNamespace, + Subsystem: metrics.CentralSubsystem.String(), + Name: "process_indicators_lineage_size", + Help: "Distribution of process lineage sizes in characters for upserted indicators", + Buckets: []float64{0, 128, 256, 512, 1024, 2048, 4096, 8192, 16384, 32768, 65536}, + }, []string{"cluster", "namespace"}) ) func incrementPrunedProcessesMetric(num int) { @@ -67,16 +75,38 @@ func getProcessArgsSizeChars(indicator *storage.ProcessIndicator) int { return utf8.RuneCountInString(indicator.GetSignal().GetArgs()) } +// getProcessLineageSizeChars safely calculates the total size of process lineage in characters (runes). +// Returns 0 if signal or lineage are nil/empty. +func getProcessLineageSizeChars(indicator *storage.ProcessIndicator) int { + if indicator == nil || indicator.GetSignal() == nil { + return 0 + } + + lineageInfo := indicator.GetSignal().GetLineageInfo() + if len(lineageInfo) == 0 { + return 0 + } + + totalChars := 0 + for _, info := range lineageInfo { + if info != nil { + totalChars += utf8.RuneCountInString(info.GetParentExecFilePath()) + } + } + + return totalChars +} + // recordProcessIndicatorsBatchAdded records metrics for a batch of process indicators successfully written to DB. func recordProcessIndicatorsBatchAdded(indicators []*storage.ProcessIndicator) { for _, indicator := range indicators { argsSizeChars := getProcessArgsSizeChars(indicator) + lineageSizeChars := getProcessLineageSizeChars(indicator) clusterID := indicator.GetClusterId() namespace := indicator.GetNamespace() - processUpsertedArgsSizeHistogram.Observe(float64(argsSizeChars)) - processUpsertedArgsSizeTotal.WithLabelValues(clusterID, namespace).Add(float64(argsSizeChars)) + processIndicatorsLineageSizeHistogram.WithLabelValues(clusterID, namespace).Observe(float64(lineageSizeChars)) } } @@ -87,5 +117,6 @@ func init() { processPruningCacheMisses, processUpsertedArgsSizeHistogram, processUpsertedArgsSizeTotal, + processIndicatorsLineageSizeHistogram, ) } From 313987106cc15d161f497d64d0693f4e5a199365 Mon Sep 17 00:00:00 2001 From: JoukoVirtanen Date: Fri, 13 Mar 2026 10:34:28 -0700 Subject: [PATCH 3/3] There is just one histogram for central. Process lineage lengths are still broken down by cluster and namespace --- central/processindicator/datastore/metrics.go | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/central/processindicator/datastore/metrics.go b/central/processindicator/datastore/metrics.go index 8b95c282b9742..e7977611ac718 100644 --- a/central/processindicator/datastore/metrics.go +++ b/central/processindicator/datastore/metrics.go @@ -45,12 +45,19 @@ var ( Help: "Total process argument sizes in characters by cluster and namespace", }, []string{"cluster", "namespace"}) - processIndicatorsLineageSizeHistogram = prometheus.NewHistogramVec(prometheus.HistogramOpts{ + processIndicatorsLineageSizeHistogram = prometheus.NewHistogram(prometheus.HistogramOpts{ Namespace: metrics.PrometheusNamespace, Subsystem: metrics.CentralSubsystem.String(), Name: "process_indicators_lineage_size", Help: "Distribution of process lineage sizes in characters for upserted indicators", Buckets: []float64{0, 128, 256, 512, 1024, 2048, 4096, 8192, 16384, 32768, 65536}, + }) + + processIndicatorsLineageSizeTotal = prometheus.NewCounterVec(prometheus.CounterOpts{ + Namespace: metrics.PrometheusNamespace, + Subsystem: metrics.CentralSubsystem.String(), + Name: "process_indicators_lineage_size_total", + Help: "Total process lineage sizes in characters by cluster and namespace", }, []string{"cluster", "namespace"}) ) @@ -104,9 +111,12 @@ func recordProcessIndicatorsBatchAdded(indicators []*storage.ProcessIndicator) { lineageSizeChars := getProcessLineageSizeChars(indicator) clusterID := indicator.GetClusterId() namespace := indicator.GetNamespace() + processUpsertedArgsSizeHistogram.Observe(float64(argsSizeChars)) processUpsertedArgsSizeTotal.WithLabelValues(clusterID, namespace).Add(float64(argsSizeChars)) - processIndicatorsLineageSizeHistogram.WithLabelValues(clusterID, namespace).Observe(float64(lineageSizeChars)) + + processIndicatorsLineageSizeHistogram.Observe(float64(lineageSizeChars)) + processIndicatorsLineageSizeTotal.WithLabelValues(clusterID, namespace).Add(float64(lineageSizeChars)) } } @@ -118,5 +128,6 @@ func init() { processUpsertedArgsSizeHistogram, processUpsertedArgsSizeTotal, processIndicatorsLineageSizeHistogram, + processIndicatorsLineageSizeTotal, ) }