CPU usage is not getting detected by Tracee

[rohitburke]

Description

I thought of using Tracee to detect the CPU usage done by my program. Tracee was not able to detect anything then I use another program that intentionally increase the CPU usage in the background. So to check that with Tracee I also ran Top as I was using it earlier to detect any CPU usage. So, the program which I ran was basically encrypting a file of 100 MB.

You can see in the image where I filtered the getcpu event for CPU detection but it fail to show any output. Although, at the same time Top was able to detect a CPU usage of 17.5%. Still, I gave one more try by running some other programs to disturb my CPU but Tracee wasn't able to detect it. The only time when Tracee gets the CPU warning is when I ran a fork Bomb on my machine. Then only it shows some events.

Let me know why Tracee was not able to detect CPU usage by running those programs. I thought Tracee already has the capability to measure CPU and memory usage on our device.

Output of tracee version:

v0.14.2

Output of uname -a:

Linux kali 6.1.0-kali7-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.20-2kali1 (2023-04-18) x86_64 GNU/Linux

[yanivagman]

Tracee doesn't have an event to detect CPU or memory usage.
The getcpu event is actually a system call used to "determine CPU and NUMA node on which the calling thread is running" (https://man7.org/linux/man-pages/man2/getcpu.2.html)

[rafaeldtinoco]

As documented at https://aquasecurity.github.io/tracee/v0.15/docs/events/builtin/syscalls/getcpu/ as well.

[rohitburke]

Okay, so it is not possible to detect CPU or Memory usage through Tracee?

[rohitburke]

Tracee doesn't have any feature to capture CPU or Memory usage. @rafaeldtinoco @yanivagman

[rafaeldtinoco]

No it does not. It would have to have "time interval" based events reporting statistics about one (or a set) of events for one (or a set) of CPUs or NUMA domains. We don't have that in our plans or the roadmap (at least until now or proved required for some specific security purpose I believe).