refactor!(libsinsp): coherent metrics interface metrics_collector class + text-based Prometheus exposition format support

test/libscap/test_suites/engines/bpf/bpf.cpp

@@ -129,17 +129,17 @@ TEST(bpf, double_scap_stats_call)
 	scap_close(h);
 }
 
-TEST(bpf, scap_stats_v2_check_results)
+TEST(bpf, metrics_v2_check_results)
 {
 	char error_buffer[SCAP_LASTERR_SIZE] = {0};
 	int ret = 0;
 	scap_t* h = open_bpf_engine(error_buffer, &ret, 4 * 4096, LIBSCAP_TEST_BPF_PROBE_PATH);
 	ASSERT_FALSE(!h || ret != SCAP_SUCCESS) << "unable to open bpf engine: " << error_buffer << std::endl;
 
-	uint32_t flags = PPM_SCAP_STATS_KERNEL_COUNTERS | PPM_SCAP_STATS_LIBBPF_STATS;
+	uint32_t flags = METRICS_V2_KERNEL_COUNTERS | METRICS_V2_LIBBPF_STATS;
 	uint32_t nstats;
 	int32_t rc;
-	const scap_stats_v2* stats_v2 = scap_get_stats_v2(h, flags, &nstats, &rc);
+	const metrics_v2* stats_v2 = scap_get_stats_v2(h, flags, &nstats, &rc);
 	ASSERT_EQ(rc, SCAP_SUCCESS);
 	ASSERT_GT(nstats, 0);
 
@@ -169,14 +169,14 @@ TEST(bpf, scap_stats_v2_check_results)
 	scap_close(h);
 }
 
-TEST(bpf, double_scap_stats_v2_call)
+TEST(bpf, double_metrics_v2_call)
 {
 	char error_buffer[SCAP_LASTERR_SIZE] = {0};
 	int ret = 0;
 	scap_t* h = open_bpf_engine(error_buffer, &ret, 4 * 4096, LIBSCAP_TEST_BPF_PROBE_PATH);
 	ASSERT_FALSE(!h || ret != SCAP_SUCCESS) << "unable to open bpf engine: " << error_buffer << std::endl;
 
-	uint32_t flags = PPM_SCAP_STATS_KERNEL_COUNTERS | PPM_SCAP_STATS_LIBBPF_STATS;
+	uint32_t flags = METRICS_V2_KERNEL_COUNTERS | METRICS_V2_LIBBPF_STATS;
 	uint32_t nstats;
 	int32_t rc;
 
@@ -192,7 +192,7 @@ TEST(bpf, double_scap_stats_v2_call)
 	scap_close(h);
 }
 
-TEST(bpf, scap_stats_v2_check_empty)
+TEST(bpf, metrics_v2_check_empty)
 {
 	char error_buffer[SCAP_LASTERR_SIZE] = {0};
 	int ret = 0;

test/libscap/test_suites/engines/kmod/kmod.cpp

@@ -184,17 +184,17 @@ TEST(kmod, double_scap_stats_call)
 	scap_close(h);
 }
 
-TEST(kmod, scap_stats_v2_check_results)
+TEST(kmod, metrics_v2_check_results)
 {
 	char error_buffer[SCAP_LASTERR_SIZE] = {0};
 	int ret = 0;
 	scap_t* h = open_kmod_engine(error_buffer, &ret, 4 * 4096, LIBSCAP_TEST_KERNEL_MODULE_PATH);
 	ASSERT_FALSE(!h || ret != SCAP_SUCCESS) << "unable to open kmod engine: " << error_buffer << std::endl;
 
-	uint32_t flags = PPM_SCAP_STATS_KERNEL_COUNTERS | PPM_SCAP_STATS_LIBBPF_STATS;
+	uint32_t flags = METRICS_V2_KERNEL_COUNTERS | METRICS_V2_LIBBPF_STATS;
 	uint32_t nstats;
 	int32_t rc;
-	const scap_stats_v2* stats_v2 = scap_get_stats_v2(h, flags, &nstats, &rc);
+	const metrics_v2* stats_v2 = scap_get_stats_v2(h, flags, &nstats, &rc);
 	ASSERT_EQ(rc, SCAP_SUCCESS);
 	ASSERT_GT(nstats, 0);
 
@@ -220,14 +220,14 @@ TEST(kmod, scap_stats_v2_check_results)
 	scap_close(h);
 }
 
-TEST(kmod, double_scap_stats_v2_call)
+TEST(kmod, double_metrics_v2_call)
 {
 	char error_buffer[SCAP_LASTERR_SIZE] = {0};
 	int ret = 0;
 	scap_t* h = open_kmod_engine(error_buffer, &ret, 4 * 4096, LIBSCAP_TEST_KERNEL_MODULE_PATH);
 	ASSERT_FALSE(!h || ret != SCAP_SUCCESS) << "unable to open kmod engine: " << error_buffer << std::endl;
 
-	uint32_t flags = PPM_SCAP_STATS_KERNEL_COUNTERS;
+	uint32_t flags = METRICS_V2_KERNEL_COUNTERS;
 	uint32_t nstats;
 	int32_t rc;
 
@@ -243,7 +243,7 @@ TEST(kmod, double_scap_stats_v2_call)
 	scap_close(h);
 }
 
-TEST(kmod, scap_stats_v2_check_empty)
+TEST(kmod, metrics_v2_check_empty)
 {
 	char error_buffer[SCAP_LASTERR_SIZE] = {0};
 	int ret = 0;

test/libscap/test_suites/engines/modern_bpf/modern_bpf.cpp

@@ -248,18 +248,18 @@ TEST(modern_bpf, double_scap_stats_call)
 	scap_close(h);
 }
 
-TEST(modern_bpf, scap_stats_v2_check_results)
+TEST(modern_bpf, metrics_v2_check_results)
 {
 	char error_buffer[FILENAME_MAX] = {0};
 	int ret = 0;
 	/* We use buffers of 1 MB to be sure that we don't have drops */
 	scap_t* h = open_modern_bpf_engine(error_buffer, &ret, 1 * 1024 * 1024, 0, false);
 	ASSERT_EQ(!h || ret != SCAP_SUCCESS, false) << "unable to open modern bpf engine with one single shared ring buffer: " << error_buffer << std::endl;
 
-	uint32_t flags = PPM_SCAP_STATS_KERNEL_COUNTERS | PPM_SCAP_STATS_LIBBPF_STATS;
+	uint32_t flags = METRICS_V2_KERNEL_COUNTERS | METRICS_V2_LIBBPF_STATS;
 	uint32_t nstats;
 	int32_t rc;
-	const scap_stats_v2* stats_v2 = scap_get_stats_v2(h, flags, &nstats, &rc);
+	const metrics_v2* stats_v2 = scap_get_stats_v2(h, flags, &nstats, &rc);
 	ASSERT_EQ(rc, SCAP_SUCCESS);
 	ASSERT_GT(nstats, 0);
 
@@ -289,7 +289,7 @@ TEST(modern_bpf, scap_stats_v2_check_results)
 	scap_close(h);
 }
 
-TEST(modern_bpf, scap_stats_v2_check_empty)
+TEST(modern_bpf, metrics_v2_check_empty)
 {
 	char error_buffer[FILENAME_MAX] = {0};
 	int ret = 0;
@@ -306,15 +306,15 @@ TEST(modern_bpf, scap_stats_v2_check_empty)
 	scap_close(h);
 }
 
-TEST(modern_bpf, double_scap_stats_v2_call)
+TEST(modern_bpf, double_metrics_v2_call)
 {
 	char error_buffer[FILENAME_MAX] = {0};
 	int ret = 0;
 	/* We use buffers of 1 MB to be sure that we don't have drops */
 	scap_t* h = open_modern_bpf_engine(error_buffer, &ret, 1 * 1024 * 1024, 0, false);
 	ASSERT_EQ(!h || ret != SCAP_SUCCESS, false) << "unable to open modern bpf engine with one single shared ring buffer: " << error_buffer << std::endl;
 
-	uint32_t flags = PPM_SCAP_STATS_KERNEL_COUNTERS | PPM_SCAP_STATS_LIBBPF_STATS;
+	uint32_t flags = METRICS_V2_KERNEL_COUNTERS | METRICS_V2_LIBBPF_STATS;
 	uint32_t nstats;
 	int32_t rc;
 

userspace/libpman/include/libpman.h

@@ -29,7 +29,7 @@ extern "C"
 #endif
 
 	/* Forward declare them */
-	struct scap_stats_v2;
+	struct metrics_v2;
 	struct scap_stats;
 
 	/* `libpman` return values convention:
@@ -300,15 +300,15 @@ extern "C"
 	int pman_get_scap_stats(struct scap_stats* scap_stats_struct);
 
 	/**
-	 * @brief Return a `scap_stats_v2` struct filled with statistics.
+	 * @brief Return a `metrics_v2` struct filled with statistics.
 	 *
 	 * @param flags holding statistics category flags.
 	 * @param nstats number of stats allocated.
 	 * @param rc return code, SCAP_FAILURE in case of error.
 	 *
-	 * @return pointer to `struct scap_stats_v2`
+	 * @return pointer to `struct metrics_v2`
 	 */
-	struct scap_stats_v2* pman_get_scap_stats_v2(uint32_t flags, uint32_t* nstats, int32_t* rc);
+	struct metrics_v2* pman_get_metrics_v2(uint32_t flags, uint32_t* nstats, int32_t* rc);
 
 	/**
 	 * @brief Receive an array with `nCPUs` elements. For every CPU

userspace/libpman/src/state.h

@@ -32,7 +32,7 @@ limitations under the License.
 /* Pay attention this need to be bumped every time we add a new bpf program that is directly attached into the kernel */
 #define MODERN_BPF_PROG_ATTACHED_MAX 9
 
-struct scap_stats_v2;
+struct metrics_v2;
 
 struct internal_state
 {
@@ -57,7 +57,7 @@ struct internal_state
 	int32_t attached_progs_fds[MODERN_BPF_PROG_ATTACHED_MAX]; /* file descriptors of attached programs, used to
 								     collect stats */
 	uint16_t n_attached_progs;				  /* number of attached progs */
-	struct scap_stats_v2* stats;				  /* array of stats collected by libpman */
+	struct metrics_v2* stats;				  /* array of stats collected by libpman */
 
 	falcosecurity_log_fn log_fn;
 };

userspace/libpman/src/stats.c

@@ -139,7 +139,7 @@ int pman_get_scap_stats(struct scap_stats *stats)
 	return errno;
 }
 
-struct scap_stats_v2 *pman_get_scap_stats_v2(uint32_t flags, uint32_t *nstats, int32_t *rc)
+struct metrics_v2 *pman_get_metrics_v2(uint32_t flags, uint32_t *nstats, int32_t *rc)
 {
 	*rc = SCAP_FAILURE;
 	/* This is the expected number of stats */
@@ -150,17 +150,17 @@ struct scap_stats_v2 *pman_get_scap_stats_v2(uint32_t flags, uint32_t *nstats, i
 	/* If it is the first time we call this function we populate the stats */
 	if(g_state.stats == NULL)
 	{
-		g_state.stats = (scap_stats_v2 *)calloc(*nstats, sizeof(scap_stats_v2));
+		g_state.stats = (metrics_v2 *)calloc(*nstats, sizeof(metrics_v2));
 		if(g_state.stats == NULL)
 		{
-			pman_print_error("unable to allocate memory for 'scap_stats_v2' array");
+			pman_print_error("unable to allocate memory for 'metrics_v2' array");
 			return NULL;
 		}
 	}
 
 	/* KERNEL COUNTER STATS */
 
-	if(flags & PPM_SCAP_STATS_KERNEL_COUNTERS)
+	if(flags & METRICS_V2_KERNEL_COUNTERS)
 	{
 		char error_message[MAX_ERROR_MESSAGE_LEN];
 		int counter_maps_fd = bpf_map__fd(g_state.skel->maps.counter_maps);
@@ -172,10 +172,12 @@ struct scap_stats_v2 *pman_get_scap_stats_v2(uint32_t flags, uint32_t *nstats, i
 
 		for(uint32_t stat = 0; stat < MODERN_BPF_MAX_KERNEL_COUNTERS_STATS; stat++)
 		{
-			g_state.stats[stat].type = STATS_VALUE_TYPE_U64;
-			g_state.stats[stat].flags = PPM_SCAP_STATS_KERNEL_COUNTERS;
+			g_state.stats[stat].type = METRIC_VALUE_TYPE_U64;
+			g_state.stats[stat].flags = METRICS_V2_KERNEL_COUNTERS;
+			g_state.stats[stat].unit = METRIC_VALUE_UNIT_COUNT;
+			g_state.stats[stat].metric_type = METRIC_VALUE_METRIC_TYPE_MONOTONIC;
 			g_state.stats[stat].value.u64 = 0;
-			strlcpy(g_state.stats[stat].name, modern_bpf_kernel_counters_stats_names[stat], STATS_NAME_MAX);
+			strlcpy(g_state.stats[stat].name, modern_bpf_kernel_counters_stats_names[stat], METRIC_NAME_MAX);
 		}
 
 		/* We always take statistics from all the CPUs, even if some of them are not online.
@@ -221,7 +223,7 @@ struct scap_stats_v2 *pman_get_scap_stats_v2(uint32_t flags, uint32_t *nstats, i
 	 * Meanwhile, we can simulate perf comparisons between future LSM hooks and sys enter and exit tracepoints
 	 * via leveraging syscall selection mechanisms `handle->curr_sc_set`.
 	 */
-	if((flags & PPM_SCAP_STATS_LIBBPF_STATS))
+	if((flags & METRICS_V2_LIBBPF_STATS))
 	{
 		for(int bpf_prog = 0; bpf_prog < MODERN_BPF_PROG_ATTACHED_MAX; bpf_prog++)
 		{
@@ -247,28 +249,36 @@ struct scap_stats_v2 *pman_get_scap_stats_v2(uint32_t flags, uint32_t *nstats, i
 					pman_print_error("no enough space for all the stats");
 					return NULL;
 				}
-				g_state.stats[offset].type = STATS_VALUE_TYPE_U64;
-				g_state.stats[offset].flags = PPM_SCAP_STATS_LIBBPF_STATS;
-				strlcpy(g_state.stats[offset].name, info.name, STATS_NAME_MAX);
+				g_state.stats[offset].type = METRIC_VALUE_TYPE_U64;
+				g_state.stats[offset].flags = METRICS_V2_LIBBPF_STATS;
+				strlcpy(g_state.stats[offset].name, info.name, METRIC_NAME_MAX);
 				switch(stat)
 				{
 				case RUN_CNT:
 					strlcat(g_state.stats[offset].name, modern_bpf_libbpf_stats_names[RUN_CNT], sizeof(g_state.stats[offset].name));
+					g_state.stats[stat].flags = METRICS_V2_KERNEL_COUNTERS;
+					g_state.stats[stat].unit = METRIC_VALUE_UNIT_COUNT;
+					g_state.stats[stat].metric_type = METRIC_VALUE_METRIC_TYPE_MONOTONIC;
 					g_state.stats[offset].value.u64 = info.run_cnt;
 					break;
 				case RUN_TIME_NS:
 					strlcat(g_state.stats[offset].name, modern_bpf_libbpf_stats_names[RUN_TIME_NS], sizeof(g_state.stats[offset].name));
+					g_state.stats[stat].unit = METRIC_VALUE_UNIT_TIME_NS_COUNT;
+					g_state.stats[stat].metric_type = METRIC_VALUE_METRIC_TYPE_MONOTONIC;
 					g_state.stats[offset].value.u64 = info.run_time_ns;
 					break;
 				case AVG_TIME_NS:
 					strlcat(g_state.stats[offset].name, modern_bpf_libbpf_stats_names[AVG_TIME_NS], sizeof(g_state.stats[offset].name));
+					g_state.stats[stat].unit = METRIC_VALUE_UNIT_TIME_NS;
+					g_state.stats[stat].metric_type = METRIC_VALUE_METRIC_TYPE_NON_MONOTONIC_CURRENT;
 					g_state.stats[offset].value.u64 = 0;
 					if(info.run_cnt > 0)
 					{
 						g_state.stats[offset].value.u64 = info.run_time_ns / info.run_cnt;
 					}
 					break;
 				default:
+					ASSERT(false);
 					break;
 				}
 				offset++;

userspace/libscap/engine/bpf/bpf.h

@@ -22,7 +22,7 @@ limitations under the License.
 #include <libscap/ringbuffer/devset.h>
 #include <libscap/scap_open.h>
 #include <libscap/engine/bpf/attached_prog.h>
-#include <libscap/scap_stats_v2.h>
+#include <libscap/metrics_v2.h>
 #include <libscap/engine/bpf/scap_bpf_stats.h>
 
 //
@@ -58,7 +58,7 @@ struct bpf_engine
 	uint64_t m_api_version;
 	uint64_t m_schema_version;
 	bool capturing;
-	scap_stats_v2* m_stats;
+	metrics_v2* m_stats;
 	uint32_t m_nstats;
 	uint64_t m_flags;
 };