tetra: Add support to display throttle events

Adding support to display throttle events in getevents like:

💥 exit    ubuntu-22 /home/jolsa/tetragon/contrib/tester-progs/forkbomb 10000000 1
🚀 process ubuntu-22 /usr/bin/git commit --amend
🧬 throttle ubuntu-22 /usr/bin/git session-154.scope CLONE
🚀 process ubuntu-22 /usr/bin/vim /home/jolsa/tetragon/.git/COMMIT_EDITMSG
🧬 throttle ubuntu-22 /home/jolsa/tetragon/contrib/tester-progs/forkbomb session-141.scope CLONE

Signed-off-by: Jiri Olsa <[email protected]>

pkg/encoder/encoder.go

@@ -213,6 +213,15 @@ func HumanStackTrace(response *tetragon.GetEventsResponse, colorer *Colorer) str
 	return out.String()
 }
 
+type Op tetragon.OpType
+
+func (op Op) String() string {
+	return [...]string{
+		5:  "EXECVE",
+		23: "CLONE",
+	}[op]
+}
+
 func (p *CompactEncoder) EventToString(response *tetragon.GetEventsResponse) (string, error) {
 	switch response.Event.(type) {
 	case *tetragon.GetEventsResponse_ProcessExec:
@@ -239,6 +248,17 @@ func (p *CompactEncoder) EventToString(response *tetragon.GetEventsResponse) (st
 			status = p.Colorer.Red.Sprint(exit.Status)
 		}
 		return CapTrailorPrinter(fmt.Sprintf("%s %s %s %s", event, processInfo, args, status), caps), nil
+	case *tetragon.GetEventsResponse_ProcessThrottle:
+		throttle := response.GetProcessThrottle()
+		if throttle.Process == nil {
+			return "", ErrMissingProcessInfo
+		}
+		event := p.Colorer.Red.Sprintf("🧬 %-7s", "throttle")
+		processInfo, caps := p.Colorer.ProcessInfo(response.NodeName, throttle.Process)
+		cgroup := throttle.Cgroup
+		op := Op(throttle.Op).String()
+		return CapTrailorPrinter(fmt.Sprintf("%s %s %s %s", event, processInfo, cgroup,
+			op), caps), nil
 	case *tetragon.GetEventsResponse_ProcessLoader:
 		loader := response.GetProcessLoader()
 		if loader.Process == nil {

pkg/grpc/exec/exec.go

@@ -558,6 +558,7 @@ func GetProcessThrottle(msg *MsgProcessThrottleUnix) *tetragon.ProcessThrottle {
 		Process: tetragonProcess,
 		Parent:  tetragonParent,
 		Op:      tetragon.OpType(msg.Event),
+		Cgroup:  msg.Cgroup,
 	}
 
 	if ec := eventcache.Get(); ec != nil &&