flag(stores): new flag format #5012

josedonizetti · 2025-11-04T14:00:34Z

New stores flag:

--stores dns.enabled 
--stores dns.max-entries=<entries>
--stores process.enabled 
--stores process.max-processes=<num_processes> 
--stores process.max-threads=<num_threads> 
--stores process.source=<source>
--stores process.use-procfs

⚠️ Breaking change: Old flags are removed.

codecov · 2025-11-04T15:32:40Z

Codecov Report

❌ Patch coverage is 68.42105% with 42 lines in your changes missing coverage. Please review.
✅ Project coverage is 31.09%. Comparing base (034cbab) to head (5750274).
⚠️ Report is 71 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/cmd/flags/stores.go	74.57%	28 Missing and 2 partials ⚠️
pkg/cmd/cobra/cobra.go	0.00%	5 Missing ⚠️
cmd/tracee/cmd/root.go	0.00%	4 Missing ⚠️
cmd/tracee/cmd/man.go	25.00%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5012      +/-   ##
==========================================
+ Coverage   29.72%   31.09%   +1.36%     
==========================================
  Files         234      234              
  Lines       26186    26691     +505     
==========================================
+ Hits         7785     8300     +515     
+ Misses      17864    17849      -15     
- Partials      537      542       +5

Flag	Coverage Δ
unit	`31.09% <68.42%> (+1.36%)`	⬆️

Files with missing lines	Coverage Δ
pkg/cmd/flags/config.go	`95.37% <100.00%> (+95.37%)`	⬆️
pkg/datastores/dns/dnscache.go	`85.71% <ø> (ø)`
pkg/datastores/process/proctree.go	`30.49% <ø> (-1.35%)`	⬇️
cmd/tracee/cmd/man.go	`40.62% <25.00%> (-0.34%)`	⬇️
cmd/tracee/cmd/root.go	`0.00% <0.00%> (ø)`
pkg/cmd/cobra/cobra.go	`0.00% <0.00%> (ø)`
pkg/cmd/flags/stores.go	`74.57% <74.57%> (ø)`

... and 21 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

geyslan

LGTM, some thoughts were put.

geyslan · 2025-12-04T15:30:54Z

pkg/cmd/flags/stores_test.go

+					Procfs:       true,
+				},
+			},
+			expectedError: "flags.PrepareStores: invalid stores flag: invalid-flag=value, use 'trace man stores' for more info",


as mentioned in other prs.

pkg/datastores/dns/dnscache.go

pkg/datastores/process/proctree.go

tests/e2e-inst-signatures/e2e-proctree_data_source.go

BREAKING CHANGE: add flag --stores to replace --proctree --dnscache

yanivagman · 2025-12-07T16:43:16Z

docs/docs/advanced/data-sources/builtin/process-tree.md


 ```bash
-sudo tracee --output option:sort-events --output json --output option:parse-arguments --proctree source=both --events <event_type>
+sudo tracee --output option:sort-events --output json --output option:parse-arguments --stores process.enabled --stores process.source=both --events <event_type>


Is it required to set --stores process.enabled if the user selected --stores process.source=both? if not, can we auto enable when process.source is specified and remove the need to specify process.enabled?

yanivagman · 2025-12-07T16:45:57Z

docs/docs/flags/stores.1.md

+- **process.max-threads**=*size*: Set the maximum number of threads to cache in the process tree. Default is 21856. This is an LRU cache that will evict least recently accessed entries when full.
+
+- **process.source**=*source*: Set the source for process tree enrichment. Valid values are:
+  - **none**: Process tree source is disabled (default).


Can we remove this "none" option now that we added the enabled config?
I believe we should remove it and make signals the default

yanivagman · 2025-12-07T16:48:26Z

docs/docs/flags/stores.1.md

+4. Enable process tree with custom cache sizes:
+   ```console
+   --stores process.enabled --stores process.max-processes=8192 --stores process.max-threads=16384
+   ```
+
+5. Enable process tree with events source:
+   ```console
+   --stores process.enabled --stores process.source=events
+   ```
+
+6. Enable process tree with both events and signals sources:
+   ```console
+   --stores process.enabled --stores process.source=both
+   ```
+
+7. Enable process tree with procfs support:
+   ```console
+   --stores process.enabled --stores process.use-procfs
+   ```
+
+8. Combine DNS and process stores:
+   ```console
+   --stores dns.enabled --stores dns.max-entries=5000 --stores process.enabled --stores process.source=both --stores process.max-processes=8192
+   ```
+
+9. Complete configuration example:
+   ```console
+   --stores dns.enabled --stores dns.max-entries=5000 --stores process.enabled --stores process.max-processes=8192 --stores process.max-threads=16384 --stores process.source=both --stores process.use-procfs
+   ```


Same suggestion as before about the syntactic sugar of not requiring to specify "enabled" when some other configuration of the datastore is given

yanivagman · 2025-12-07T16:49:07Z

docs/docs/flags/stores.1.md

+   --stores dns.enabled --stores dns.max-entries=5000 --stores process.enabled --stores process.max-processes=8192 --stores process.max-threads=16384 --stores process.source=both --stores process.use-procfs
+   ```
+
+Please refer to the [DNS data source documentation](../advanced/data-sources/builtin/dns.md) and [Process Tree data source documentation](../advanced/data-sources/builtin/process-tree.md) for more information.


This should be modified after we will merge the new datastores PR to point to datastores instead of datasources (deprecated)

yanivagman · 2025-12-07T16:51:34Z

docs/docs/install/config/index.md



-  __NOTE__: You can view more in the [Process Tree section](../../advanced/data-sources/builtin/process-tree.md).
+  __NOTE__: You can view more in the [Process Tree section](../../advanced/data-sources/builtin/process-tree.md) and [DNS Cache section](../../advanced/data-sources/builtin/dns.md).


This note should refer to the new datastores docs once merged

yanivagman · 2025-12-07T16:55:22Z

pkg/cmd/cobra/cobra.go

+	cfg.ProcTree = stores.GetProcTreeConfig()
+	cfg.DNSCacheConfig = stores.GetDNSCacheConfig()


FYI this will soon be changed by one of the followup commits of detectors where all datastores are grouped together (see detectors draft PR)

github-actions bot assigned josedonizetti Nov 4, 2025

github-actions bot added area/testing area/UX area/flags labels Nov 4, 2025

josedonizetti force-pushed the newStoresFlag branch from df23d14 to 7266606 Compare November 4, 2025 15:21

josedonizetti force-pushed the newStoresFlag branch 2 times, most recently from c173b06 to 326ef06 Compare November 8, 2025 01:06

josedonizetti force-pushed the newStoresFlag branch from 326ef06 to 2ccc599 Compare November 27, 2025 01:47

github-actions bot added the kind/documentation label Nov 27, 2025

josedonizetti force-pushed the newStoresFlag branch 4 times, most recently from 422800f to 067ff81 Compare November 27, 2025 02:35

josedonizetti requested a review from yanivagman November 27, 2025 02:40

josedonizetti marked this pull request as ready for review November 27, 2025 02:40

josedonizetti force-pushed the newStoresFlag branch from 067ff81 to 5d26dba Compare November 27, 2025 02:50

github-actions bot added the area/kubernetes label Nov 27, 2025

josedonizetti force-pushed the newStoresFlag branch from 5d26dba to 135640a Compare November 30, 2025 01:42

josedonizetti requested a review from geyslan December 4, 2025 13:11

geyslan approved these changes Dec 4, 2025

View reviewed changes

josedonizetti force-pushed the newStoresFlag branch from 135640a to 67d9bb8 Compare December 5, 2025 00:09

josedonizetti mentioned this pull request Dec 5, 2025

Refactor datastores names #5097

Open

flag(stores)!: new flag format

5750274

BREAKING CHANGE: add flag --stores to replace --proctree --dnscache

josedonizetti force-pushed the newStoresFlag branch from 67d9bb8 to 5750274 Compare December 6, 2025 19:25

josedonizetti requested a review from geyslan December 7, 2025 06:35

yanivagman requested changes Dec 7, 2025

View reviewed changes

josedonizetti marked this pull request as draft December 8, 2025 22:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

flag(stores): new flag format #5012

flag(stores): new flag format #5012

Uh oh!

josedonizetti commented Nov 4, 2025 •

edited

Loading

Uh oh!

codecov bot commented Nov 4, 2025 •

edited

Loading

Uh oh!

geyslan left a comment

Uh oh!

geyslan Dec 4, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

yanivagman Dec 7, 2025

Uh oh!

yanivagman Dec 7, 2025

Uh oh!

yanivagman Dec 7, 2025

Uh oh!

yanivagman Dec 7, 2025

Uh oh!

yanivagman Dec 7, 2025

Uh oh!

yanivagman Dec 7, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants



		__NOTE__: You can view more in the [Process Tree section](../../advanced/data-sources/builtin/process-tree.md).
		__NOTE__: You can view more in the [Process Tree section](../../advanced/data-sources/builtin/process-tree.md) and [DNS Cache section](../../advanced/data-sources/builtin/dns.md).

		cfg.ProcTree = stores.GetProcTreeConfig()
		cfg.DNSCacheConfig = stores.GetDNSCacheConfig()

flag(stores): new flag format #5012

Are you sure you want to change the base?

flag(stores): new flag format #5012

Uh oh!

Conversation

josedonizetti commented Nov 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Nov 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

geyslan left a comment

Choose a reason for hiding this comment

Uh oh!

geyslan Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

yanivagman Dec 7, 2025

Choose a reason for hiding this comment

Uh oh!

yanivagman Dec 7, 2025

Choose a reason for hiding this comment

Uh oh!

yanivagman Dec 7, 2025

Choose a reason for hiding this comment

Uh oh!

yanivagman Dec 7, 2025

Choose a reason for hiding this comment

Uh oh!

yanivagman Dec 7, 2025

Choose a reason for hiding this comment

Uh oh!

yanivagman Dec 7, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

josedonizetti commented Nov 4, 2025 •

edited

Loading

codecov bot commented Nov 4, 2025 •

edited

Loading