working nginx tracer

Author: tahsina13

docker-compose.yaml

@@ -4,15 +4,15 @@ services:
   # trace help only builds the image and runs the help command
   # to ensure the docker pipeline works without any errors.
   trace-help:
-    image: ghcr.io/amirhnajafiz/flap:v0.0.0-beta-8
+    image: ghcr.io/amirhnajafiz/flap:v0.0.0-beta-9
     entrypoint: ["/usr/local/app/trace.sh"]
     command: ["-h"]
 
   # user end-to-end test runs a tracing operation to validate the
   # program functionality. If it works successfully, you should be able
   # to see the output in tests/logs directory.
   e2e:
-    image: ghcr.io/amirhnajafiz/flap:v0.0.0-beta-8
+    image: ghcr.io/amirhnajafiz/flap:v0.0.0-beta-9
     privileged: true
     network_mode: host
     pid: host

k8s/bpftrace.yaml k8s/nginx-tracer.yamlk8s/bpftrace.yaml renamed to k8s/nginx-tracer.yaml

@@ -4,7 +4,7 @@ metadata:
   name: nginx-service
 spec:
   selector:
-    app: bpftrace
+    app: nginx-tracer
   ports:
     - name: http-web-svc
       port: 80
@@ -14,14 +14,15 @@ spec:
 apiVersion: v1
 kind: Pod
 metadata:
-  name: bpftrace-test
+  name: nginx-tracer
   labels: 
-    app: bpftrace
+    app: nginx-tracer
 spec:
-  shareProcessNamespace: true   # allow containers to see each other's processes
+  hostPID: true
   initContainers:
     - name: bpftrace
-      image: ghcr.io/amirhnajafiz/flap:v0.0.0-beta-8
+      image: ghcr.io/amirhnajafiz/flap:v0.0.0-beta-9
+      imagePullPolicy: Never
       restartPolicy: Always
       securityContext:
         privileged: true                # or at least add CAP_SYS_PTRACE

src/scripts/ntrace.bt

@@ -8,6 +8,11 @@
  *   sudo bpftrace -o tracing.out ntrace.bt <NAME>
  */
 
+BEGIN
+{
+  printf("[%s] START tracing file-access events for %s\n", strftime("%Y-%m-%d %H:%M:%S", nsecs), str($1));
+}
+
 /* when we see a fork, if parent is tracked then also track child */
 tracepoint:sched:sched_process_fork
 / @tracked[args->parent_pid] /