Plugins 〉Hubble Process Ancestry


Developer

Isovalent Inc.


Sign up to receive occasional product news and updates:



Panel
commercial

Hubble Process Ancestry

  • Overview
  • Installation
  • Change log
  • Related content

Hubble Process Ancestry panel plugin for Grafana

Grafana panel plugin that allows to visualize Hubble Process Ancestry directly in Grafana interface. It requires Isovalent Cilium Enterprise.

Requirements

A compatible Grafana datasource plugin is required for this plugin to work. Currently there is Hubble datasource plugin available.

Usage

On dashboard that supposed to show process ancestry add variable "Pod" that fetches pods list from datasource plugin.

Add panel plugin on dashboard by searching visualization "hubble process ancestry", selecting appropriate datasource plugin, "Process Ancestry" query type and "${Pod} = ..." value in "Pod" dropdown.

Data schema

Currently two data frame types are supported: for PROCESS_EXEC and PROCESS_CONNECT events.

PROCESS_EXEC

fieldtypesample
node_namestringminikube
timenumber1675087549022
kindstringPROCESS_EXEC
idstringminikube/1675087549.22000000/PROCESS_EXEC/bWluaWt1YmU6MjA2NjkwMDAwMDAwOjIzMTU2
process/exec_idstringbWluaWt1YmU6MjA2NjkwMDAwMDAwOjIzMTU2
process/pidnumber23156
process/uidnumber23156
process/cwdstring/
process/binarystring/minio-operator
process/argumentsstring
process/flagsstringprocFS auid rootcwd
process/start_timenumber1675087549022
process/auidnumber0
process/dockerstring97b5d10913ddc80e4409e715f0c73e2
process/parent_exec_idstringbWluaWt1YmU6MjA2NjMwMDAwMDAwOjIzMTMy
process/refcntnumber0
process/pod/namespacestringminio
process/pod/namestringminio-operator-5f4cb79d7c-6rzr6
process/pod/labelsstringk8s:app.kubernetes.io/instance=minio-operator,k8s:app.kubernetes.io/name=operator,k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=minio,k8s:io.cilium.k8s.namespace.labels.name=minio,k8s:io.cilium.k8s.policy.cluster=default,k8s:io.cilium.k8s.policy.serviceaccount=minio-operator,k8s:io.kubernetes.pod.namespace=minio,k8s:operator=leader
process/pod/container/idstringdocker://97b5d10913ddc80e4409e715f0c73e2d77a57d133a88baa6330a3d488202ec45
process/pod/container/namestringoperator
process/pod/container/start_time1675087549000
process/pod/container/pidnumber1
process/pod/container/maybe_exec_probebooleanfalse
process/pod/container/image/idstringdocker-pullable://minio/operator@sha256:5f5f31cf46a7683dc37aeaf598baf552640c03ac6fc8f2aac169e015d077e935
process/pod/container/image/namestringminio/operator:v4.5.1
parent/exec_idstringbWluaWt1YmU6MjA2NjMwMDAwMDAwOjIzMTMy
parent/pidnumber23132
parent/uidnumber23132
parent/cwdstring/run/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/97b5d10913ddc80e4409e715f0c73e2d77a57d133a88baa6330a3d488202ec45
parent/binarystring/usr/bin/containerd-shim
parent/argumentsstring-namespace moby -workdir /var/lib/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/97b5d10913ddc80e4409e715f0c73e2d77a57d133a88baa6330a3d488202ec45 -address /var/run/docker/containerd/containerd.sock -containerd-binary /usr/bin/containerd -runtime-root /var/run/docker/runtime-runc -systemd-cgroup
parent/flagsstringprocFS auid
parent/start_timenumber1675087548962
parent/auidnumber0
parent/dockerstring
parent/parent_exec_idstringbWluaWt1YmU6MTI0OTYwMDAwMDAwOjE3NDc1
parent/refcntnumber0

PROCESS_CONNECT

fieldtypesample
node_namestringminikube
timenumber1674748552434
kindstringPROCESS_CONNECT
idstringminikube/1674748552.434000000/PROCESS_CONNECT/bWluaWt1YmU6MTMxMzQwMDAwMDAwOjIwMzA5
process/exec_idstringbWluaWt1YmU6MTMxMzQwMDAwMDAwOjIwMzA5
process/pidnumber20309
process/uidnumber20309
process/cwdstring/
process/binarystring/minio-operator
process/argumentsstring
process/flagsstringprocFS auid rootcwd
process/start_time1674748552434
process/auidnumber0
process/dockerstringda15ebaf7183a00c0a5e949ad535167
process/parent_exec_idstringbWluaWt1YmU6MTMxMzIwMDAwMDAwOjIwMjky
process/refcntnumber0
process/pod/namespacestringminio
process/pod/namestringminio-operator-5f4cb79d7c-6rzr6
process/pod/labelsstring
process/pod/container/idstringdocker://da15ebaf7183a00c0a5e949ad5351671936c9a765b0d1a3ef27eed1cfa6e49fc
process/pod/container/namestringoperator
process/pod/container/start_timestring1674748552000
process/pod/container/pidnumber1
process/pod/container/maybe_exec_probestring
-----------------
node_namestringminikube
timenumber1674748552434
kindstringPROCESS_CONNECT
idstringminikube/1674748552.434000000/PROCESS_CONNECT/bWluaWt1YmU6MTMxMzQwMDAwMDAwOjIwMzA5
process/exec_idstringbWluaWt1YmU6MTMxMzQwMDAwMDAwOjIwMzA5
process/pidnumber20309
process/uidnumber20309
process/cwdstring/
process/binarystring/minio-operator
process/argumentsstring
process/flagsstringprocFS auid rootcwd
process/start_time1674748552434
process/auidnumber0
process/dockerstringda15ebaf7183a00c0a5e949ad535167
process/parent_exec_idstringbWluaWt1YmU6MTMxMzIwMDAwMDAwOjIwMjky
process/refcntnumber0
process/pod/namespacestring?minio
process/pod/namestring?minio-operator-5f4cb79d7c-6rzr6
process/pod/labelsstring?
process/pod/container/idstring?docker://da15ebaf7183a00c0a5e949ad5351671936c9a765b0d1a3ef27eed1cfa6e49fc
process/pod/container/namestring?operator
process/pod/container/start_timestring?1674748552000
process/pod/container/pidnumber?1
process/pod/container/maybe_exec_probeboolean?false
process/pod/container/image/idstring?docker-pullable://minio/operator@sha256:5f5f31cf46a7683dc37aeaf598baf552640c03ac6fc8f2aac169e015d077e935
process/pod/container/image/namestring?minio/operator:v4.5.1
parent/exec_idstringbWluaWt1YmU6MTMxMzIwMDAwMDAwOjIwMjky
parent/pidnumber20292
parent/uidnumber20292
parent/cwdstring/run/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/da15ebaf7183a00c0a5e949ad5351671936c9a765b0d1a3ef27eed1cfa6e49fc
parent/binarystring/usr/bin/containerd-shim
parent/argumentsstring-namespace moby -workdir /var/lib/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/da15ebaf7183a00c0a5e949ad5351671936c9a765b0d1a3ef27eed1cfa6e49fc -address /var/run/docker/containerd/containerd.sock -containerd-binary /usr/bin/containerd -runtime-root /var/run/docker/runtime-runc -systemd-cgroup
parent/flagsstringprocFS auid
parent/start_time1674748552414
parent/auidnumber0
parent/dockerstring
parent/parent_exec_idstringbWluaWt1YmU6OTcyOTAwMDAwMDA6MTIyNTc=
parent/refcntnumber0
source_ipstring10.88.0.38
source_portnumber55142
destination_ipstring10.96.0.1
destination_portstring443
destination_namesstring
sock_cookienumber0
protocolnumber6
process/pod/container/image/idstringdocker-pullable://minio/operator@sha256:5f5f31cf46a7683dc37aeaf598baf552640c03ac6fc8f2aac169e015d077e935
process/pod/container/image/namestringminio/operator:v4.5.1
parent/exec_idstringbWluaWt1YmU6MTMxMzIwMDAwMDAwOjIwMjky
parent/pidnumber20292
parent/uidnumber20292
parent/cwdstring/run/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/da15ebaf7183a00c0a5e949ad5351671936c9a765b0d1a3ef27eed1cfa6e49fc
parent/binarystring/usr/bin/containerd-shim
parent/argumentsstring-namespace moby -workdir /var/lib/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/da15ebaf7183a00c0a5e949ad5351671936c9a765b0d1a3ef27eed1cfa6e49fc -address /var/run/docker/containerd/containerd.sock -containerd-binary /usr/bin/containerd -runtime-root /var/run/docker/runtime-runc -systemd-cgroup
parent/flagsstringprocFS auid
parent/start_time1674748552414
parent/auidnumber0
parent/dockerstring
parent/parent_exec_idstringbWluaWt1YmU6OTcyOTAwMDAwMDA6MTIyNTc=
parent/refcntnumber0
source_ipstring10.88.0.38
source_portnumber55142
destination_ipstring10.96.0.1
destination_portstring443
destination_namesstring
sock_cookienumber0
protocolnumber6

Installing Hubble Process Ancestry on Grafana Cloud:

For more information, visit the docs on plugin installation.

Changelog

1.0.3

  • Added missed dark theme icons

1.0.2

  • Update Process Ancestry component (@isovalent/grafana-process-tree v0.3.0) with performance improvements and fixes
  • Make Process Ancestry scrollable
  • Upgrade dependencies
  • Migrate from Yarn to NPM

1.0.1

  • Add LICENSE and COPYRIGHT.
  • Update README.md
  • Update the logo

1.0.0

Initial release.