diff --git a/docs/content/en/docs/reference/metrics.md b/docs/content/en/docs/reference/metrics.md index 59419fe6901..cae0b65b9db 100644 --- a/docs/content/en/docs/reference/metrics.md +++ b/docs/content/en/docs/reference/metrics.md @@ -42,7 +42,7 @@ The total number of Tetragon errors. For internal use only. | label | values | | ----- | ------ | -| `type ` | `event_finalize_process_info_failed, event_missing_process_info, handler_error, process_cache_evicted, process_cache_miss_on_get, process_cache_miss_on_remove, process_pid_tid_mismatch` | +| `type ` | `event_finalize_process_info_failed, event_missing_process_info, handler_error, process_cache_evicted, process_cache_miss_on_get, process_cache_miss_on_remove, process_metadata_username_failed, process_metadata_username_ignored_not_in_host_namespaces, process_pid_tid_mismatch` | ### `tetragon_event_cache_accesses_total` diff --git a/pkg/metrics/errormetrics/errormetrics.go b/pkg/metrics/errormetrics/errormetrics.go index 008dd5fa03c..a60f6d0bbe7 100644 --- a/pkg/metrics/errormetrics/errormetrics.go +++ b/pkg/metrics/errormetrics/errormetrics.go @@ -28,16 +28,23 @@ const ( HandlerError // An event finalizer on Process failed EventFinalizeProcessInfoFailed + // Failed to resolve Process uid to username + ProcessMetadataUsernameFailed + // The username resolution was skipped since the process is not in host + // namespaces. + ProcessMetadataUsernameIgnoredNotInHost ) var errorTypeLabelValues = map[ErrorType]string{ - ProcessCacheMissOnGet: "process_cache_miss_on_get", - ProcessCacheEvicted: "process_cache_evicted", - ProcessCacheMissOnRemove: "process_cache_miss_on_remove", - ProcessPidTidMismatch: "process_pid_tid_mismatch", - EventMissingProcessInfo: "event_missing_process_info", - HandlerError: "handler_error", - EventFinalizeProcessInfoFailed: "event_finalize_process_info_failed", + ProcessCacheMissOnGet: "process_cache_miss_on_get", + ProcessCacheEvicted: "process_cache_evicted", + ProcessCacheMissOnRemove: "process_cache_miss_on_remove", + ProcessPidTidMismatch: "process_pid_tid_mismatch", + EventMissingProcessInfo: "event_missing_process_info", + HandlerError: "handler_error", + EventFinalizeProcessInfoFailed: "event_finalize_process_info_failed", + ProcessMetadataUsernameFailed: "process_metadata_username_failed", + ProcessMetadataUsernameIgnoredNotInHost: "process_metadata_username_ignored_not_in_host_namespaces", } func (e ErrorType) String() string { diff --git a/pkg/sensors/exec/userinfo/userinfo.go b/pkg/sensors/exec/userinfo/userinfo.go index 5a9c0c8bc11..ee01a753edb 100644 --- a/pkg/sensors/exec/userinfo/userinfo.go +++ b/pkg/sensors/exec/userinfo/userinfo.go @@ -8,6 +8,7 @@ import ( "github.com/cilium/tetragon/pkg/api/processapi" "github.com/cilium/tetragon/pkg/grpc/exec" + "github.com/cilium/tetragon/pkg/metrics/errormetrics" "github.com/cilium/tetragon/pkg/option" "github.com/cilium/tetragon/pkg/reader/namespace" "github.com/cilium/tetragon/pkg/reader/userdb" @@ -36,11 +37,17 @@ func getAccountUnix(uid uint32, ns *processapi.MsgNamespaces) (string, error) { func MsgToExecveAccountUnix(m *exec.MsgExecveEventUnix) error { if option.Config.UsernameMetadata == int(option.USERNAME_METADATA_UNIX) { username, err := getAccountUnix(m.Unix.Process.UID, &m.Unix.Msg.Namespaces) - if err != nil { - return err + if err == nil { + m.Unix.Process.User.Name = username + return nil } - m.Unix.Process.User.Name = username + if errors.Is(err, ErrNotInHostNs) { + errormetrics.ErrorTotalInc(errormetrics.ProcessMetadataUsernameIgnoredNotInHost) + } else { + errormetrics.ErrorTotalInc(errormetrics.ProcessMetadataUsernameFailed) + } + return err } return nil }