From 4d21f7a6757eda1031b0090be3953415f7d37aa8 Mon Sep 17 00:00:00 2001 From: Mauro Ezequiel Moltrasio Date: Mon, 17 Aug 2026 13:01:04 +0200 Subject: [PATCH] cleanup: host scanner metrics track all alternatives and total Use the `Total` label in host scanner to track the total events processed by it instead of `Added`, which is now used to track how many events are moved to the next event correctly. While working on this, I also decided to add new labels for the cases of `MkDir`, `RmDir` and `Mount`, all of which are not forwarded. Also fixed a small inconsistency in the bpf module that was tracking ignored events as `Dropped`. --- fact/src/bpf/mod.rs | 2 +- fact/src/host_scanner.rs | 17 +++++++--- fact/src/metrics/host_scanner.rs | 55 +++++++++++++++++++++++--------- 3 files changed, 53 insertions(+), 21 deletions(-) diff --git a/fact/src/bpf/mod.rs b/fact/src/bpf/mod.rs index c8fc8851..d97d0f20 100644 --- a/fact/src/bpf/mod.rs +++ b/fact/src/bpf/mod.rs @@ -318,7 +318,7 @@ impl Bpf { // decision there. if !event.is_monitored_by_parent() && event.is_ignored(&self.paths_globset) { - self.metrics.dropped(); + self.metrics.ignored(); continue; } event diff --git a/fact/src/host_scanner.rs b/fact/src/host_scanner.rs index b5252601..83a9326c 100644 --- a/fact/src/host_scanner.rs +++ b/fact/src/host_scanner.rs @@ -49,7 +49,7 @@ use crate::{ bpf::Bpf, event::Event, host_info, - metrics::host_scanner::{HostScannerMetrics, ScanLabels}, + metrics::host_scanner::{HostScannerLabels, HostScannerMetrics, ScanLabels}, }; struct InodeMap(HashMap); @@ -503,7 +503,7 @@ You can increase this limit with: info!("No more events to process"); break; }; - self.metrics.events.added(); + self.metrics.events_inc(HostScannerLabels::Total); // Handle file and directory creation events by adding new inodes to the map if event.is_creation() && @@ -513,6 +513,7 @@ You can increase this limit with: // Handle mount events and move on. if event.is_mount_related() { + self.metrics.events_inc(HostScannerLabels::Mount); self.handle_mount_event(); continue; } @@ -533,7 +534,11 @@ You can increase this limit with: } // Skip directory creation and deletion events - we track them internally but don't send to sensor - if event.is_mkdir() || event.is_rmdir() { + if event.is_mkdir() { + self.metrics.events_inc(HostScannerLabels::MkDir); + continue; + } else if event.is_rmdir() { + self.metrics.events_inc(HostScannerLabels::RmDir); continue; } @@ -547,13 +552,15 @@ You can increase this limit with: // maps to prevent it from sending more events. self.inode_map.borrow_mut().remove(event.get_inode()); let _ = self.kernel_inode_map.borrow_mut().remove(event.get_inode()); - self.metrics.events.ignored(); + self.metrics.events_inc(HostScannerLabels::Ignored); continue; } if let Err(e) = self.tx.send(event).await { - self.metrics.events.dropped(); + self.metrics.events_inc(HostScannerLabels::Dropped); warn!("Failed to send event: {e}"); + } else { + self.metrics.events_inc(HostScannerLabels::Added); } }, req = self.introspection.recv() => { diff --git a/fact/src/metrics/host_scanner.rs b/fact/src/metrics/host_scanner.rs index 3b106381..10066a20 100644 --- a/fact/src/metrics/host_scanner.rs +++ b/fact/src/metrics/host_scanner.rs @@ -4,8 +4,6 @@ use prometheus_client::{ registry::Registry, }; -use crate::metrics::{EventCounter, LabelValues as EventLabels}; - #[derive(Clone, Hash, Eq, Debug, PartialEq, EncodeLabelValue, Copy)] pub enum ScanLabels { Scans, @@ -26,27 +24,44 @@ pub struct ScanEvents { label: ScanLabels, } +#[derive(Clone, Hash, Eq, Debug, PartialEq, EncodeLabelValue, Copy)] +pub enum HostScannerLabels { + Total, + Added, + Dropped, + Ignored, + MkDir, + RmDir, + Mount, +} + +#[derive(Clone, Hash, Eq, Debug, PartialEq, EncodeLabelSet)] +pub struct HostScannerEvents { + label: HostScannerLabels, +} + #[derive(Debug, Clone)] /// Metrics for the HostScanner component pub struct HostScannerMetrics { - pub events: EventCounter, + pub events: Family>, pub scan: Family>, pub scan_duration: Histogram, } impl HostScannerMetrics { pub(super) fn new() -> Self { - let labels = [ - EventLabels::Total, - EventLabels::Added, - EventLabels::Dropped, - EventLabels::Ignored, - ]; - let events = EventCounter::new( - "host_scanner_events", - "Events processed by the host scanner component", - &labels, - ); + let events = Family::>::default(); + for label in [ + HostScannerLabels::Total, + HostScannerLabels::Added, + HostScannerLabels::Dropped, + HostScannerLabels::Ignored, + HostScannerLabels::MkDir, + HostScannerLabels::RmDir, + HostScannerLabels::Mount, + ] { + let _ = events.get_or_create(&HostScannerEvents { label }); + } let scan: Family> = Default::default(); for label in [ @@ -76,7 +91,11 @@ impl HostScannerMetrics { } pub(super) fn register(&self, reg: &mut Registry) { - self.events.register(reg); + reg.register( + "host_scanner_events", + "Events processed by the host scanner component", + self.events.clone(), + ); reg.register( "host_scanner_scan", "Counter of events by scans from the host scanner component", @@ -90,6 +109,12 @@ impl HostScannerMetrics { ); } + pub fn events_inc(&self, label: HostScannerLabels) { + self.events + .get_or_create(&HostScannerEvents { label }) + .inc(); + } + pub fn scan_inc(&self, label: ScanLabels) { self.scan.get_or_create(&ScanEvents { label }).inc(); }