refactor(telemetry): Retire threadpool telemetry

configs/fibratus.yml

@@ -252,9 +252,6 @@ eventsource:
   # Determines whether DNS client events are collected
   #enable-dns: true
 
-  # Determines whether thread pool events are collected
-  #enable-threadpool: true
-
   # Indicates if stack enrichment is enabled for eligible events
   #stack-enrichment: true
 

internal/etw/source.go

@@ -138,7 +138,6 @@ func (e *EventSource) Open(config *config.Config) error {
 		config.EventSource.EnableMemEvents = config.EventSource.EnableMemEvents && (e.r.HasMemEvents || (config.Yara.Enabled && !config.Yara.SkipAllocs))
 		config.EventSource.EnableDNSEvents = config.EventSource.EnableDNSEvents && e.r.HasDNSEvents
 		config.EventSource.EnableAuditAPIEvents = config.EventSource.EnableAuditAPIEvents && e.r.HasAuditAPIEvents
-		config.EventSource.EnableThreadpoolEvents = config.EventSource.EnableThreadpoolEvents && e.r.HasThreadpoolEvents
 		for _, typ := range event.All() {
 			if typ == event.CreateProcess || typ == event.TerminateProcess ||
 				typ == event.LoadModule || typ == event.UnloadModule {
@@ -197,17 +196,6 @@ func (e *EventSource) Open(config *config.Config) error {
 		trace.AddProvider(etw.KernelAuditAPICallsGUID, config.EventSource.StackEnrichment)
 	}
 
-	if config.EventSource.EnableThreadpoolEvents {
-		// thread pool provider must be configured with
-		// stack extensions to activate stack walks events
-		var stackexts *StackExtensions
-		if e.config.EventSource.StackEnrichment {
-			stackexts = NewStackExtensions(config.EventSource)
-			stackexts.EnableThreadpoolCallstack()
-		}
-		trace.AddProvider(etw.ThreadpoolGUID, config.EventSource.StackEnrichment, WithStackExts(stackexts))
-	}
-
 	// add security telemetry trace
 	e.addTrace(trace)
 	// add the core NT Kernel Logger trace

internal/etw/stackext.go

@@ -103,12 +103,3 @@ func (s *StackExtensions) EnableMemoryCallstack() {
 		s.AddStackTracing(event.VirtualAlloc)
 	}
 }
-
-// EnableThreadpoolCallstack enables stack tracing for thread pool events.
-func (s *StackExtensions) EnableThreadpoolCallstack() {
-	if s.config.EnableThreadpoolEvents {
-		s.AddStackTracing(event.SubmitThreadpoolWork)
-		s.AddStackTracing(event.SubmitThreadpoolCallback)
-		s.AddStackTracing(event.SetThreadpoolTimer)
-	}
-}

internal/etw/trace.go

@@ -50,18 +50,10 @@ type ProviderInfo struct {
 	// CaptureState requests that the provider log its state
 	// information, such as rundown events.
 	CaptureState bool
-	// stackExtensions manager stack tracing enablement.
-	// For each event present in the stack identifiers,
-	// the StackWalk event is published by the provider.
-	stackExtensions *StackExtensions
 	//eventFilterDescriptors stores the provider-specific filters.
 	eventFilterDescriptors []etw.EventFilterDescriptor
 }
 
-func (p *ProviderInfo) HasStackExtensions() bool {
-	return p.stackExtensions != nil && !p.stackExtensions.Empty()
-}
-
 func (p *ProviderInfo) HasEventFilterDescriptors() bool {
 	return len(p.eventFilterDescriptors) > 0
 }
@@ -138,11 +130,6 @@ type trace struct {
 	// name represents the unique tracing session name.
 	name string
 
-	// stackExtensions manages stack tracing enablement.
-	// For each event present in the stack identifiers,
-	// the StackWalk event is published by the provider.
-	stackExtensions *StackExtensions
-
 	// controlHandle is the session handle returned by the
 	// etw.StartTrace function. This handle is
 	// used for subsequent calls to other API
@@ -228,6 +215,10 @@ func (t *trace) Close() error {
 // events from the global NT Kernel Logger session.
 type KernelTrace struct {
 	trace
+	// stackExtensions manages stack tracing enablement.
+	// For each event present in the stack identifiers,
+	// the StackWalk event is published by the provider.
+	stackExtensions *StackExtensions
 }
 
 // UserTrace is responsible for starting a private tracing
@@ -242,7 +233,6 @@ type UserTrace struct {
 	Providers []ProviderInfo
 }
 type opts struct {
-	stackexts              *StackExtensions
 	keywords               uint64
 	captureState           bool
 	eventFilterDescriptors []etw.EventFilterDescriptor
@@ -251,13 +241,6 @@ type opts struct {
 // Option represents the option for the trace.
 type Option func(o *opts)
 
-// WithStackExts sets the stack extensions.
-func WithStackExts(stackexts *StackExtensions) Option {
-	return func(o *opts) {
-		o.stackexts = stackexts
-	}
-}
-
 // WithKeywords sets the bitmask of keywords that determine
 // the categories of events for the provider to emit.
 func WithKeywords(keywords uint64) Option {
@@ -284,7 +267,7 @@ func WithEventFilterDescriptors(descriptors ...etw.EventFilterDescriptor) Option
 
 // NewKernelTrace creates a new NT Kernel Logger trace.
 func NewKernelTrace(config *config.Config) *KernelTrace {
-	t := &KernelTrace{trace: trace{guid: etw.KernelTraceControlGUID, name: etw.KernelLoggerSession, stackExtensions: NewStackExtensions(config.EventSource), config: config}}
+	t := &KernelTrace{trace: trace{guid: etw.KernelTraceControlGUID, name: etw.KernelLoggerSession, config: config}, stackExtensions: NewStackExtensions(config.EventSource)}
 
 	t.stackExtensions.EnableProcessCallstack()
 	t.stackExtensions.EnableRegistryCallstack()
@@ -314,7 +297,7 @@ func (t *UserTrace) AddProvider(guid windows.GUID, enableStacks bool, options ..
 
 	t.Providers = append(
 		t.Providers,
-		ProviderInfo{GUID: guid, Keywords: opts.keywords, EnableStacks: enableStacks, CaptureState: opts.captureState, stackExtensions: opts.stackexts, eventFilterDescriptors: opts.eventFilterDescriptors},
+		ProviderInfo{GUID: guid, Keywords: opts.keywords, EnableStacks: enableStacks, CaptureState: opts.captureState, eventFilterDescriptors: opts.eventFilterDescriptors},
 	)
 }
 
@@ -400,13 +383,6 @@ func (t *UserTrace) Start() error {
 	// data item section when writing events to the session buffers
 	for _, provider := range t.Providers {
 		switch {
-		case provider.EnableStacks && provider.HasStackExtensions():
-			if err := etw.EnableStackTracing(t.controlHandle, provider.stackExtensions.EventIds()); err != nil {
-				return fmt.Errorf("fail to enable provider callstack tracing: %v", err)
-			}
-			if err := etw.EnableTrace(provider.GUID, t.controlHandle, provider.Keywords); err != nil {
-				return err
-			}
 		case provider.EnableStacks || provider.HasEventFilterDescriptors():
 			opts := etw.EnableTraceOpts{
 				WithStacktrace:         provider.EnableStacks,

pkg/config/config.schema.json

@@ -362,9 +362,6 @@
         "enable-dns": {
           "type": "boolean"
         },
-        "enable-threadpool": {
-          "type": "boolean"
-        },
         "stack-enrichment": {
           "type": "boolean"
         },
@@ -428,10 +425,7 @@
                   "ReplyDns",
                   "VirtualAlloc",
                   "VirtualFree",
-                  "CreateSymbolicLinkObject",
-                  "SubmitThreadpoolWork",
-                  "SubmitThreadpoolCallback",
-                  "SetThreadpoolTimer"
+                  "CreateSymbolicLinkObject"
                 ]
               }
             },

pkg/config/config_windows.go

@@ -428,7 +428,6 @@ func (c *Config) addFlags() {
 		c.flags.Bool(enableMemEvents, true, "Determines whether memory manager events are collected by Kernel Logger provider")
 		c.flags.Bool(enableAuditAPIEvents, true, "Determines whether kernel audit API calls events are published")
 		c.flags.Bool(enableDNSEvents, true, "Determines whether DNS client events are enabled")
-		c.flags.Bool(enableThreadpoolEvents, true, "Determines whether thread pool events are published")
 		c.flags.Bool(stackEnrichment, true, "Indicates if stack enrichment is enabled for eligible events")
 		c.flags.Int(bufferSize, int(maxBufferSize), "Represents the amount of memory allocated for each event tracing session buffer, in kilobytes. The buffer size affects the rate at which buffers fill and must be flushed (small buffer size requires less memory but it increases the rate at which buffers must be flushed)")
 		c.flags.Int(minBuffers, int(defaultMinBuffers), "Determines the minimum number of buffers allocated for the event tracing session's buffer pool")

pkg/config/eventsource.go

@@ -33,21 +33,20 @@ import (
 )
 
 const (
-	enableThreadEvents     = "eventsource.enable-thread"
-	enableRegistryEvents   = "eventsource.enable-registry"
-	enableNetEvents        = "eventsource.enable-net"
-	enableFileIOEvents     = "eventsource.enable-fileio"
-	enableVAMapEvents      = "eventsource.enable-vamap"
-	enableModuleEvents     = "eventsource.enable-module"
-	enableMemEvents        = "eventsource.enable-mem"
-	enableAuditAPIEvents   = "eventsource.enable-audit-api"
-	enableDNSEvents        = "eventsource.enable-dns"
-	enableThreadpoolEvents = "eventsource.enable-threadpool"
-	stackEnrichment        = "eventsource.stack-enrichment"
-	bufferSize             = "eventsource.buffer-size"
-	minBuffers             = "eventsource.min-buffers"
-	maxBuffers             = "eventsource.max-buffers"
-	flushInterval          = "eventsource.flush-interval"
+	enableThreadEvents   = "eventsource.enable-thread"
+	enableRegistryEvents = "eventsource.enable-registry"
+	enableNetEvents      = "eventsource.enable-net"
+	enableFileIOEvents   = "eventsource.enable-fileio"
+	enableVAMapEvents    = "eventsource.enable-vamap"
+	enableModuleEvents   = "eventsource.enable-module"
+	enableMemEvents      = "eventsource.enable-mem"
+	enableAuditAPIEvents = "eventsource.enable-audit-api"
+	enableDNSEvents      = "eventsource.enable-dns"
+	stackEnrichment      = "eventsource.stack-enrichment"
+	bufferSize           = "eventsource.buffer-size"
+	minBuffers           = "eventsource.min-buffers"
+	maxBuffers           = "eventsource.max-buffers"
+	flushInterval        = "eventsource.flush-interval"
 
 	excludedEvents = "eventsource.blacklist.events"
 	excludedImages = "eventsource.blacklist.images"
@@ -81,8 +80,6 @@ type EventSourceConfig struct {
 	EnableAuditAPIEvents bool `json:"enable-audit-api" yaml:"enable-audit-api"`
 	// EnableDNSEvents indicates if DNS client events are enabled
 	EnableDNSEvents bool `json:"enable-dns" yaml:"enable-dns"`
-	// EnableThreadpoolEvents indicates if thread pool events are enabled
-	EnableThreadpoolEvents bool `json:"enable-threadpool" yaml:"enable-threadpool"`
 	// StackEnrichment indicates if stack enrichment is enabled for eligible events.
 	StackEnrichment bool `json:"stack-enrichment" yaml:"stack-enrichment"`
 	// BufferSize represents the amount of memory allocated for each event tracing session buffer, in kilobytes.
@@ -116,7 +113,6 @@ func (c *EventSourceConfig) initFromViper(v *viper.Viper) {
 	c.EnableMemEvents = v.GetBool(enableMemEvents)
 	c.EnableAuditAPIEvents = v.GetBool(enableAuditAPIEvents)
 	c.EnableDNSEvents = v.GetBool(enableDNSEvents)
-	c.EnableThreadpoolEvents = v.GetBool(enableThreadpoolEvents)
 	c.StackEnrichment = v.GetBool(stackEnrichment)
 	c.BufferSize = uint32(v.GetInt(bufferSize))
 	c.MinBuffers = uint32(v.GetInt(minBuffers))

pkg/config/filters.go

@@ -188,20 +188,19 @@ func (ctx *ActionContext) UniquePids() []uint32 {
 // enabling/disabling event providers/types
 // dynamically.
 type RulesCompileResult struct {
-	HasProcEvents       bool
-	HasThreadEvents     bool
-	HasModuleEvents     bool
-	HasFileEvents       bool
-	HasNetworkEvents    bool
-	HasRegistryEvents   bool
-	HasMemEvents        bool
-	HasVAMapEvents      bool
-	HasDNSEvents        bool
-	HasAuditAPIEvents   bool
-	HasThreadpoolEvents bool
-	UsedEvents          []event.Type
-	NumberRules         int
-	Approvers           Approvers
+	HasProcEvents     bool
+	HasThreadEvents   bool
+	HasModuleEvents   bool
+	HasFileEvents     bool
+	HasNetworkEvents  bool
+	HasRegistryEvents bool
+	HasMemEvents      bool
+	HasVAMapEvents    bool
+	HasDNSEvents      bool
+	HasAuditAPIEvents bool
+	UsedEvents        []event.Type
+	NumberRules       int
+	Approvers         Approvers
 }
 
 type Approvers struct {
@@ -287,7 +286,6 @@ func (r RulesCompileResult) String() string {
 		HasVAMapEvents: %t
 		HasAuditAPIEvents: %t
 		HasDNSEvents: %t
-		HasThreadpoolEvents: %t
 		Events: %s
 		Approvers: %s`,
 		r.HasProcEvents,
@@ -300,7 +298,6 @@ func (r RulesCompileResult) String() string {
 		r.HasVAMapEvents,
 		r.HasAuditAPIEvents,
 		r.HasDNSEvents,
-		r.HasThreadpoolEvents,
 		strings.Join(events, ", "),
 		r.Approvers,
 	)

pkg/event/category.go

@@ -47,8 +47,6 @@ const (
 	Mem Category = "mem"
 	// Object the category for object manager events
 	Object Category = "object"
-	// Threadpool is the category for thread pool events
-	Threadpool Category = "threadpool"
 	// Other is the category for uncategorized events
 	Other Category = "other"
 	// Unknown is the category for events that couldn't match any of the previous categories
@@ -68,7 +66,7 @@ func (c Category) Hash() uint32 {
 }
 
 // MaxCategoryIndex designates the maximum category index.
-const MaxCategoryIndex = 12
+const MaxCategoryIndex = 11
 
 // Index returns a numerical category index.
 func (c Category) Index() uint8 {
@@ -86,15 +84,13 @@ func (c Category) Index() uint8 {
 	case Module:
 		return 6
 	case Driver:
-		return 8
+		return 7
 	case Mem:
-		return 9
+		return 8
 	case Object:
-		return 10
-	case Threadpool:
-		return 11
+		return 9
 	case Other:
-		return 12
+		return 10
 	default:
 		return MaxCategoryIndex
 	}
@@ -114,7 +110,6 @@ func Categories() []string {
 		string(Other),
 		string(Unknown),
 		string(Object),
-		string(Threadpool),
 	}
 }
 

pkg/event/event_windows.go

@@ -565,12 +565,6 @@ func (e *Event) Summary() string {
 		src := e.GetParamAsString(params.LinkSource)
 		target := e.GetParamAsString(params.LinkTarget)
 		return printSummary(e, fmt.Sprintf("created symbolic link from %s to %s", src, target))
-	case SubmitThreadpoolWork:
-		return printSummary(e, "enqueued the work item to the thread pool")
-	case SubmitThreadpoolCallback:
-		return printSummary(e, "Submitted the thread pool callback for execution within the work item")
-	case SetThreadpoolTimer:
-		return printSummary(e, "set thread pool timer object")
 	}
 	return ""
 }

pkg/event/metainfo_windows.go

@@ -84,9 +84,6 @@ var events = map[Type]Info{
 	QueryDNS:                 {"QueryDns", Net, "Sends a DNS query to the name server"},
 	ReplyDNS:                 {"ReplyDNS", Net, "Receives the response from the DNS server"},
 	CreateSymbolicLinkObject: {"CreateSymbolicLinkObject", Object, "Creates the symbolic link within the object manager directory"},
-	SubmitThreadpoolWork:     {"SubmitThreadpoolWork", Threadpool, "Enqueues the work item to the thread pool"},
-	SubmitThreadpoolCallback: {"SubmitThreadpoolCallback", Threadpool, "Submits the thread pool callback for execution within the work item"},
-	SetThreadpoolTimer:       {"SetThreadpoolTimer", Threadpool, "Sets the thread pool timer object"},
 }
 
 var types = map[string]Type{
@@ -140,9 +137,6 @@ var types = map[string]Type{
 	"QueryDns":                 QueryDNS,
 	"ReplyDns":                 ReplyDNS,
 	"CreateSymbolicLinkObject": CreateSymbolicLinkObject,
-	"SubmitThreadpoolWork":     SubmitThreadpoolWork,
-	"SubmitThreadpoolCallback": SubmitThreadpoolCallback,
-	"SetThreadpoolTimer":       SetThreadpoolTimer,
 }
 
 // indexedEvents keeps the slice of event infos. When the
@@ -199,9 +193,6 @@ var indexedEvents = []Info{
 	events[QueryDNS],
 	events[ReplyDNS],
 	events[CreateSymbolicLinkObject],
-	events[SubmitThreadpoolWork],
-	events[SubmitThreadpoolCallback],
-	events[SetThreadpoolTimer],
 }
 
 // All returns all event types.