refactor(telemetry): Retire handle events

cmd/fibratus/app/stats/stats.go

@@ -20,10 +20,11 @@ package stats
 
 import (
 	"encoding/json"
-	"github.com/rabbitstack/fibratus/internal/bootstrap"
 	"os"
 	"reflect"
 
+	"github.com/rabbitstack/fibratus/internal/bootstrap"
+
 	"github.com/jedib0t/go-pretty/v6/table"
 	"github.com/rabbitstack/fibratus/pkg/config"
 	errs "github.com/rabbitstack/fibratus/pkg/errors"
@@ -59,7 +60,6 @@ type Stats struct {
 	FsFileObjectMisses                  int            `json:"fs.file.object.misses"`
 	FsFileReleases                      int            `json:"fs.file.releases"`
 	FsTotalRundownFiles                 int            `json:"fs.total.rundown.files"`
-	HandleDeferredEvictions             int            `json:"handle.deferred.evictions"`
 	HandleNameQueryFailures             map[string]int `json:"handle.name.query.failures"`
 	HandleSnapshotCount                 int            `json:"handle.snapshot.count"`
 	HandleSnapshotBytes                 int            `json:"handle.snapshot.bytes"`

configs/fibratus.yml

@@ -243,10 +243,6 @@ eventsource:
   # Determines whether module events are collected by Kernel Logger provider
   #enable-module: true
 
-  # Determines whether object manager events (handle creation/destruction) are
-  # collected by Kernel Logger provider
-  #enable-handle: false
-
   # Determines whether memory manager events are collected by Kernel Logger provider
   #enable-mem: true
 

internal/etw/processors/chain_windows.go

@@ -59,9 +59,6 @@ func NewChain(
 	if config.EventSource.EnableNetEvents {
 		chain.addProcessor(newNetProcessor())
 	}
-	if config.EventSource.EnableHandleEvents {
-		chain.addProcessor(newHandleProcessor(hsnap, psnap))
-	}
 	if config.EventSource.EnableMemEvents {
 		chain.addProcessor(newMemProcessor(psnap, vaRegionProber))
 	}

internal/etw/source_test.go

@@ -112,7 +112,6 @@ func TestEventSourceStartTraces(t *testing.T) {
 					EnableNetEvents:      true,
 					EnableFileIOEvents:   true,
 					EnableVAMapEvents:    true,
-					EnableHandleEvents:   true,
 					EnableRegistryEvents: true,
 					BufferSize:           1024,
 					FlushTimer:           time.Millisecond * 2300,
@@ -141,7 +140,6 @@ func TestEventSourceStartTraces(t *testing.T) {
 					require.NoError(t, err)
 					// check enabled system event flags
 					require.Equal(t, tt.wantFlags[0], flags[0])
-					require.Equal(t, tt.wantFlags[1], flags[4])
 				}
 			}
 		})
@@ -1254,7 +1252,6 @@ func TestEvasionScanner(t *testing.T) {
 		EnableNetEvents:      true,
 		EnableRegistryEvents: false,
 		EnableMemEvents:      false,
-		EnableHandleEvents:   false,
 		EnableDNSEvents:      false,
 		EnableAuditAPIEvents: true,
 		StackEnrichment:      true,

internal/etw/trace.go

@@ -348,38 +348,24 @@ func (t *KernelTrace) Start() error {
 
 	handle := t.controlHandle
 
-	// poorly documented ETW feature that allows for enabling an extended set of
-	// kernel event tracing flags. According to the MSDN documentation, aside from
-	// invoking `EventTraceProperties` function to enable object manager tracking
-	// the `EventTraceProperties` structure's `EnableFlags` member needs to be set
-	// to PERF_OB_HANDLE (0x80000040). This actually results in an erroneous trace start.
-	// The documentation neither specifies how the function should be called, group mask
-	// array with its 4th element set to 0x80000040.
-	sysTraceFlags := make([]etw.EventTraceFlags, 8)
 	// when we call `TraceSetInformation` with event empty group mask reserved for the
 	// flags that are bitvectored into `EventTraceProperties` structure's `EnableFlags` field,
 	// it will trigger the arrival of rundown events including open file objects and
 	// registry keys that are very valuable for us to construct the initial snapshot of
 	// these system resources and let us build the state machine
+	sysTraceFlags := make([]etw.EventTraceFlags, 8)
 	if err := etw.SetTraceSystemFlags(handle, sysTraceFlags); err != nil {
 		log.Warnf("unable to set empty system flags: %v", err)
 		return nil
 	}
-	sysTraceFlags[0] = flags
-
-	// enable object manager tracking
-	if t.config.EventSource.EnableHandleEvents {
-		sysTraceFlags[4] = etw.Handle
-	}
 	// enable stack enrichment
 	if t.config.EventSource.StackEnrichment {
 		if err := etw.EnableStackTracing(handle, t.stackExtensions.EventIds()); err != nil {
 			return fmt.Errorf("fail to enable kernel callstack tracing: %v", err)
 		}
 	}
-	// call again to enable all kernel events. Just to recap. The first call to
-	// `TraceSetInformation` with empty group masks activates rundown events,
-	// while this second call enables the rest of the kernel events specified in flags.
+	// call again to enable all kernel events
+	sysTraceFlags[0] = flags
 	return etw.SetTraceSystemFlags(handle, sysTraceFlags)
 }
 

pkg/cap/reader_windows.go

@@ -204,14 +204,6 @@ func (r *reader) updateSnapshotters(evt *event.Event) error {
 		if err := r.psnapshotter.WriteFromCapture(evt); err != nil {
 			return err
 		}
-	case event.CreateHandle:
-		if err := r.hsnapshotter.Write(evt); err != nil {
-			return err
-		}
-	case event.CloseHandle:
-		if err := r.hsnapshotter.Remove(evt); err != nil {
-			return err
-		}
 	}
 	if evt.PS == nil {
 		_, evt.PS = r.psnapshotter.Find(evt.PID)

pkg/cap/writer_windows_test.go

@@ -172,7 +172,6 @@ func TestLiveCapture(t *testing.T) {
 			EnableRegistryEvents: true,
 			EnableNetEvents:      true,
 			EnableThreadEvents:   true,
-			EnableHandleEvents:   true,
 		},
 		CapFile:            "../../test.cap",
 		Filters:            &config.Filters{},

pkg/config/_fixtures/fibratus.yml

@@ -136,8 +136,6 @@ eventsource:
   blacklist:
     events:
       - CreateThread
-      - CreateHandle
-      - CloseHandle
     images:
       - System
 

pkg/config/config.schema.json

@@ -350,9 +350,6 @@
         "enable-vamap": {
           "type": "boolean"
         },
-        "enable-handle": {
-          "type": "boolean"
-        },
         "enable-net": {
           "type": "boolean"
         },
@@ -427,9 +424,6 @@
                   "Disconnect",
                   "Reconnect",
                   "Retransmit",
-                  "CreateHandle",
-                  "CloseHandle",
-                  "DuplicateHandle",
                   "QueryDns",
                   "ReplyDns",
                   "VirtualAlloc",

pkg/config/config_windows.go

@@ -425,7 +425,6 @@ func (c *Config) addFlags() {
 		c.flags.Bool(enableFileIOEvents, true, "Determines whether disk I/O events are collected by Kernel Logger provider")
 		c.flags.Bool(enableVAMapEvents, true, "Determines whether VA map/unmap events are collected by Kernel Logger provider")
 		c.flags.Bool(enableModuleEvents, true, "Determines whether module events are collected by Kernel Logger provider")
-		c.flags.Bool(enableHandleEvents, false, "Determines whether object manager events (handle creation/destruction) are collected by Kernel Logger provider")
 		c.flags.Bool(enableMemEvents, true, "Determines whether memory manager events are collected by Kernel Logger provider")
 		c.flags.Bool(enableAuditAPIEvents, true, "Determines whether kernel audit API calls events are published")
 		c.flags.Bool(enableDNSEvents, true, "Determines whether DNS client events are enabled")

pkg/config/eventsource.go

@@ -39,7 +39,6 @@ const (
 	enableFileIOEvents     = "eventsource.enable-fileio"
 	enableVAMapEvents      = "eventsource.enable-vamap"
 	enableModuleEvents     = "eventsource.enable-module"
-	enableHandleEvents     = "eventsource.enable-handle"
 	enableMemEvents        = "eventsource.enable-mem"
 	enableAuditAPIEvents   = "eventsource.enable-audit-api"
 	enableDNSEvents        = "eventsource.enable-dns"
@@ -76,8 +75,6 @@ type EventSourceConfig struct {
 	EnableVAMapEvents bool `json:"enable-vamap" yaml:"enable-vamap"`
 	// EnableModuleEvents indicates if module events are collected by the ETW provider.
 	EnableModuleEvents bool `json:"enable-image" yaml:"enable-module"`
-	// EnableHandleEvents indicates whether handle creation/disposal events are enabled.
-	EnableHandleEvents bool `json:"enable-handle" yaml:"enable-handle"`
 	// EnableMemEvents indicates whether memory manager events are enabled.
 	EnableMemEvents bool `json:"enable-memory" yaml:"enable-memory"`
 	// EnableAuditAPIEvents indicates if kernel audit API calls events are enabled
@@ -116,7 +113,6 @@ func (c *EventSourceConfig) initFromViper(v *viper.Viper) {
 	c.EnableFileIOEvents = v.GetBool(enableFileIOEvents)
 	c.EnableVAMapEvents = v.GetBool(enableVAMapEvents)
 	c.EnableModuleEvents = v.GetBool(enableModuleEvents)
-	c.EnableHandleEvents = v.GetBool(enableHandleEvents)
 	c.EnableMemEvents = v.GetBool(enableMemEvents)
 	c.EnableAuditAPIEvents = v.GetBool(enableAuditAPIEvents)
 	c.EnableDNSEvents = v.GetBool(enableDNSEvents)