New parser to extract the process state from /proc/<pid>/stat

stackrox · Dec 9, 2024 · d1fb856 · d1fb856
1 parent 80e2ebf
commit d1fb856
Show file tree

Hide file tree

Showing 3 changed files with 43 additions and 0 deletions.
diff --git a/collector/lib/ProcfsScraper.cpp b/collector/lib/ProcfsScraper.cpp
@@ -2,6 +2,7 @@
 
 #include <cctype>
 #include <cinttypes>
+#include <cstdio>
 #include <cstring>
 #include <fcntl.h>
 #include <string_view>
@@ -609,6 +610,22 @@ std::optional<std::string_view> ExtractContainerID(std::string_view cgroup_line)
   return ExtractContainerIDFromCgroup(cgroup_path);
 }
 
+std::optional<char> ExtractProcessState(std::string_view line) {
+  size_t last_parenthese;
+
+  if ((last_parenthese = line.rfind(") ")) == line.npos) {
+    return {};
+  }
+
+  line.remove_prefix(last_parenthese + 2);
+
+  if (line.empty()) {
+    return {};
+  }
+
+  return line[0];
+}
+
 bool ConnScraper::Scrape(std::vector<Connection>* connections, std::vector<ContainerEndpoint>* listen_endpoints) {
   return ReadContainerConnections(proc_path_.c_str(), process_store_, connections, listen_endpoints);
 }

diff --git a/collector/lib/ProcfsScraper_internal.h b/collector/lib/ProcfsScraper_internal.h
@@ -9,6 +9,11 @@ namespace collector {
 // ExtractContainerID tries to extract a container ID from a cgroup line.
 std::optional<std::string_view> ExtractContainerID(std::string_view cgroup_line);
 
+// ExtractProcessState retrieves the state of the process (3rd element).
+// as found in /proc/<pid>/stat.
+// Returns: the state character or nullopt in case of error.
+std::optional<char> ExtractProcessState(std::string_view proc_pid_stat_line);
+
 }  // namespace collector
 
 #endif
diff --git a/collector/test/ConnScraperTest.cpp b/collector/test/ConnScraperTest.cpp
@@ -46,6 +46,27 @@ TEST(ConnScraperTest, TestExtractContainerID) {
   }
 }
 
+TEST(ConnScraperTest, TestProcStateExtract) {
+  std::optional<char> state;
+
+  // valid line
+  state = ExtractProcessState("13934 (prog) Z 2312 13934 2312 34819 13934 4194304 94 0 0 0 0 0 0 0 20 0 1 0 608787 5758976 409 18446744073709551615 94201870180352 94201870200233 140728860702192 0 0 0 0 0 0 0 0 0 17 4 0 0 0 0 0 94201870216240 94201870217856 94202687545344 140728860710184 140728860710204 140728860710204 140728860712939 0\n");
+
+  EXPECT_TRUE(state);
+  EXPECT_EQ(*state, 'Z');
+
+  // invalid
+  state = ExtractProcessState("13934 (prog) ");
+
+  EXPECT_FALSE(state);
+
+  // program name containing ')'
+  state = ExtractProcessState("13934 (prog ) Z) R 2312 13934 2312 34819 13934 4194304 94 0 0 0 0 0 0 0 20 0 1 0 608787 5758976 409 18446744073709551615 94201870180352 94201870200233 140728860702192 0 0 0 0 0 0 0 0 0 17 4 0 0 0 0 0 94201870216240 94201870217856 94202687545344 140728860710184 140728860710204 140728860710204 140728860712939 0\n");
+
+  EXPECT_TRUE(state);
+  EXPECT_EQ(*state, 'R');
+}
+
 }  // namespace
 
 }  // namespace collector