tetragon: store the TID in the process cache directly at clone

As we generate only one clone event that is the thread leader, store directly the TID in the process cache. Signed-off-by: Djalal Harouni <[email protected]>
cilium · Jul 21, 2023 · 367e603 · 367e603
1 parent 3fb668c
commit 367e603
Showing 1 changed file with 6 additions and 4 deletions.
diff --git a/pkg/process/process.go b/pkg/process/process.go
@@ -255,12 +255,14 @@ func initProcessInternalClone(event *tetragonAPI.MsgCloneEvent,
 			"event.process.exec_id": pi.process.ExecId,
 			"event.parent.exec_id":  parentExecId,
 		}).Debug("CloneEvent: process PID and TID mismatch")
+		pi.process.Tid = &wrapperspb.UInt32Value{Value: 0}
+	} else {
+		// Set the TID here and if we have an exit without an exec we report
+		// directly this TID without copying again objects.
+		// At kprobe times we use the returned TIDs from bpf side.
+		pi.process.Tid = &wrapperspb.UInt32Value{Value: event.PID}
 	}
 
-	// This TID will be updated by the TID of the bpf execve event later,
-	// so set it to zero here and ensure that it will be updated later.
-	// Exported events must always be generated with a non zero TID.
-	pi.process.Tid = &wrapperspb.UInt32Value{Value: 0}
 	pi.process.Flags = strings.Join(exec.DecodeCommonFlags(event.Flags), " ")
 	pi.process.StartTime = ktime.ToProto(event.Ktime)
 	pi.process.Refcnt = 1