Function interposition in an observability pipeline system
In some aspects, data collection functions are interposed to generate input data for an observability pipeline system. In some aspects, a data collection function is made available to an application running on a computer system, with the data collection function having the same name as an original function referenced by the application. In response to a call to the original function, the data collection function is executed and data is extracted from the application. The original function is then executed. A reporting thread of the application is executed; executing the reporting thread generates observability pipeline input data by formatting the extracted data and sends the observability pipeline input data from the computer system to an observability pipeline system.
1 . A method comprising:
making a data collection function available to an application on a computer system;
in response to a call to an original function:
executing the data collection function on the computer system, wherein executing the data collection function comprises extracting data from the application; and
executing the original function on the computer system, wherein executing the original function returns an output to the application; and
processing the extracted data to generate observability pipeline input data for an observability pipeline system,
wherein the original function is included in a dynamically loaded library, is part of a statically linked executable, or is part of the application.
2 . The method of claim 1 , wherein making the data collection function available to the application comprises preloading a library, the library including the data collection function.
3 . The method of claim 2 , comprising configuring the library based on user input received through a command line user interface.
4 . The method of claim 1 , wherein making the data collection function available comprises saving an address of the data collection function in a Global Offsets Table.
5 . The method of claim 1 , wherein making the data collection function available comprises placing a JMP instruction in a preamble of the original function.
6 . The method of claim 1 , wherein the observability pipeline system input data comprises metrics, logs, and events.
7 . The method of claim 1 , wherein the observability pipeline system processes the observability pipeline input data by:
applying schema normalization to the observability pipeline input data to generate normalized data;
routing the normalized data to a streaming analytics and processing module;
generating structured output data from the normalized data by operation of the streaming analytics and processing module; and
applying output schemas to the structured output data to generate observability pipeline output data for a plurality of external data destinations.
8 . The method of claim 1 , wherein making the data collection function available to the application comprises:
attaching to the application by a supervising application;
saving a state of the application;
loading bootstrapping code;
executing the bootstrapping code;
as a result of executing the bootstrapping code, loading an interposition library, the interposition library comprising the data collection function;
instantiating the data collection function; and
restoring the state of the application.
9 . The method of claim 8 , wherein loading bootstrapping code comprises:
examining a memory map of the application;
locating a page of executable memory in the memory map;
saving contents of the page of executable memory; and
writing the bootstrapping code to the page of executable memory.
10 . A computer system comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
making a data collection function available to an application on the computer system;
in response to a call to an original function:
executing the data collection function on the computer system, wherein executing the data collection function comprises extracting data from the application; and
executing the original function on the computer system, wherein executing the original function returns an output to the application; and
processing the extracted data to generate observability pipeline input data for an observability pipeline system,
wherein the observability pipeline system input data comprises metrics, logs, or events.
11 . The computer system of claim 10 , wherein making the data collection function available to the application comprises preloading a library, the library including the data collection function.
12 . The computer system of claim 11 , wherein making the data collection function available to the application comprises configuring the library based on user input received through a command line user interface.
13 . The computer system of claim 10 , wherein making the data collection function available to the application comprises including the data collection function in a dynamically loaded library.
14 . The computer system of claim 10 , wherein making the data collection function available to the application comprises saving an address of the data collection function in a Global Offsets Table.
15 . The computer system of claim 10 , wherein making the data collection function available to the application comprises placing a JMP instruction in a preamble of the original function.
16 . The computer system of claim 10 , wherein making the data collection function available to the application comprises including the data collection function in a statically linked executable.
17 . The computer system of claim 10 , wherein making the data collection function available to the application comprises including the data collection function in a module of the application.
18 . A non-transitory computer-readable medium comprising instructions that are operable when executed by data processing apparatus to perform operations comprising:
making a data collection function available to an application on a computer system;
in response to a call to an original function:
executing the data collection function on the computer system, wherein executing the data collection function comprises extracting data from the application; and
executing the original function on the computer system, wherein executing the original function returns an output to the application; and
processing the extracted data to generate observability pipeline input data for an observability pipeline system,
wherein the observability pipeline system input data comprises metrics, logs, or events.
19 . The non-transitory computer-readable medium of claim 18 , wherein the original function is included in a dynamically loaded library, is part of a statically linked executable, or is part of the application.
20 . The non-transitory computer-readable medium of claim 18 , wherein making the data collection function available to the application comprises at least one of: preloading a library, the library including the data collection function, saving an address of the data collection function in a Global Offsets Table, including the data collection function in a dynamically loaded library, saving an address of the data collection function in a Global Offsets Table, placing a JMP instruction in a preamble of the original function, including the data collection function in a statically linked executable, or including the data collection function in a module of the application.
21 . The non-transitory computer-readable medium of claim 18 , wherein observability pipeline output data is generated for a plurality of external data destinations based on the observability pipeline input data and schema normalization.
22 . The computer system of claim 10 , wherein observability pipeline output data is generated for a plurality of external data destinations based on the observability pipeline input data and schema normalization.