cleanup: host scanner metrics track all alternatives and total

fact/src/bpf/mod.rs

@@ -318,7 +318,7 @@ impl Bpf {
                                     // decision there.
                                     if !event.is_monitored_by_parent() &&
                                             event.is_ignored(&self.paths_globset) {
-                                        self.metrics.dropped();
+                                        self.metrics.ignored();
                                         continue;
                                     }
                                     event

fact/src/host_scanner.rs

@@ -49,7 +49,7 @@ use crate::{
     bpf::Bpf,
     event::Event,
     host_info,
-    metrics::host_scanner::{HostScannerMetrics, ScanLabels},
+    metrics::host_scanner::{HostScannerLabels, HostScannerMetrics, ScanLabels},
 };
 
 struct InodeMap(HashMap<inode_key_t, PathBuf>);
@@ -503,7 +503,7 @@ You can increase this limit with:
                             info!("No more events to process");
                             break;
                         };
-                        self.metrics.events.added();
+                        self.metrics.events_inc(HostScannerLabels::Total);
 
                         // Handle file and directory creation events by adding new inodes to the map
                         if event.is_creation() &&
@@ -513,6 +513,7 @@ You can increase this limit with:
 
                         // Handle mount events and move on.
                         if event.is_mount_related() {
+                            self.metrics.events_inc(HostScannerLabels::Mount);
                             self.handle_mount_event();
                             continue;
                         }
@@ -533,7 +534,11 @@ You can increase this limit with:
                         }
 
                         // Skip directory creation and deletion events - we track them internally but don't send to sensor
-                        if event.is_mkdir() || event.is_rmdir() {
+                        if event.is_mkdir() {
+                            self.metrics.events_inc(HostScannerLabels::MkDir);
+                            continue;
+                        } else if event.is_rmdir() {
+                            self.metrics.events_inc(HostScannerLabels::RmDir);
                             continue;
                         }
 
@@ -547,13 +552,15 @@ You can increase this limit with:
                             // maps to prevent it from sending more events.
                             self.inode_map.borrow_mut().remove(event.get_inode());
                             let _ = self.kernel_inode_map.borrow_mut().remove(event.get_inode());
-                            self.metrics.events.ignored();
+                            self.metrics.events_inc(HostScannerLabels::Ignored);
                             continue;
                         }
 
                         if let Err(e) = self.tx.send(event).await {
-                            self.metrics.events.dropped();
+                            self.metrics.events_inc(HostScannerLabels::Dropped);
                             warn!("Failed to send event: {e}");
+                        } else {
+                            self.metrics.events_inc(HostScannerLabels::Added);
                         }
                     },
                     req = self.introspection.recv() => {

fact/src/metrics/host_scanner.rs

@@ -4,8 +4,6 @@ use prometheus_client::{
     registry::Registry,
 };
 
-use crate::metrics::{EventCounter, LabelValues as EventLabels};
-
 #[derive(Clone, Hash, Eq, Debug, PartialEq, EncodeLabelValue, Copy)]
 pub enum ScanLabels {
     Scans,
@@ -26,27 +24,44 @@ pub struct ScanEvents {
     label: ScanLabels,
 }
 
+#[derive(Clone, Hash, Eq, Debug, PartialEq, EncodeLabelValue, Copy)]
+pub enum HostScannerLabels {
+    Total,
+    Added,
+    Dropped,
+    Ignored,
+    MkDir,
+    RmDir,
+    Mount,
+}
+
+#[derive(Clone, Hash, Eq, Debug, PartialEq, EncodeLabelSet)]
+pub struct HostScannerEvents {
+    label: HostScannerLabels,
+}
+
 #[derive(Debug, Clone)]
 /// Metrics for the HostScanner component
 pub struct HostScannerMetrics {
-    pub events: EventCounter,
+    pub events: Family<HostScannerEvents, Counter<u64>>,
     pub scan: Family<ScanEvents, Counter<u64>>,
     pub scan_duration: Histogram,
 }
 
 impl HostScannerMetrics {
     pub(super) fn new() -> Self {
-        let labels = [
-            EventLabels::Total,
-            EventLabels::Added,
-            EventLabels::Dropped,
-            EventLabels::Ignored,
-        ];
-        let events = EventCounter::new(
-            "host_scanner_events",
-            "Events processed by the host scanner component",
-            &labels,
-        );
+        let events = Family::<HostScannerEvents, Counter<u64>>::default();
+        for label in [
+            HostScannerLabels::Total,
+            HostScannerLabels::Added,
+            HostScannerLabels::Dropped,
+            HostScannerLabels::Ignored,
+            HostScannerLabels::MkDir,
+            HostScannerLabels::RmDir,
+            HostScannerLabels::Mount,
+        ] {
+            let _ = events.get_or_create(&HostScannerEvents { label });
+        }
 
         let scan: Family<ScanEvents, Counter<u64>> = Default::default();
         for label in [
@@ -76,7 +91,11 @@ impl HostScannerMetrics {
     }
 
     pub(super) fn register(&self, reg: &mut Registry) {
-        self.events.register(reg);
+        reg.register(
+            "host_scanner_events",
+            "Events processed by the host scanner component",
+            self.events.clone(),
+        );
         reg.register(
             "host_scanner_scan",
             "Counter of events by scans from the host scanner component",
@@ -90,6 +109,12 @@ impl HostScannerMetrics {
         );
     }
 
+    pub fn events_inc(&self, label: HostScannerLabels) {
+        self.events
+            .get_or_create(&HostScannerEvents { label })
+            .inc();
+    }
+
     pub fn scan_inc(&self, label: ScanLabels) {
         self.scan.get_or_create(&ScanEvents { label }).inc();
     }