Collecting type of workload data by a software agent

1 . A method comprising:

one or more processing resources executing a plurality of workloads within a compute environment to generate workload data;

the one or more processing resources detecting an event occurrence based on an analysis of a first type of workload data associated with one or more of the plurality of workloads;

the one or more processing resources detecting a request for a software agent deployed within the compute environment to collect a second type of workload data associated with the one or more workloads in response to the event occurrence, wherein the second type of data is different than the first type of workload data;

the one or more processing resources directing the software agent to install a module to collect the second type of workload data in a kernel of an operating system associated with the one or more workloads, the module configured to execute in the kernel to generate the second type of workload data; and

the one or more processing resources receiving the second type of workload data collected by the software agent using the module in a dataset that uses a same schema as the first type of workload data, wherein the second type of workload data comprises events generated by the module while the module runs in the kernel, and events associated with a data source that is different than data sources associated with types of workload data collected by the software agent previous to the detecting the request.

2 . The method of claim 1 , wherein each event generated by the module is received within a row of a table that implements the schema.

3 . The method of claim 1 , wherein each event generated by the module comprises one or more fields such that content associated with the one or more fields is received in JSON format within an entry within a table that implements the schema.

4 . The method of claim 3 , further comprising the one or more processing resources generating a virtual table that exports each field of the one or more fields in a different column of the virtual table.

5 . The method of claim 1 , wherein the module is configured to filter, based on the events generated by the module, the second type of workload data while the module runs in the kernel.

6 . The method of claim 1 , wherein the module is configured to aggregate, based on the events generated by the module, the second type of workload data while the module runs in the kernel.

7 . The method of claim 1 , wherein the module is configured to filter, based on rule data accessed by the module, the second type of workload data while the module runs in the kernel.

8 . The method of claim 7 , wherein the rule data is updated by a select one or more of the one or more processing resources, the software agent, or a computing device associated with an entity associated with the compute environment.

9 . The method of claim 1 , wherein the directing the software agent to install the module comprises updating configuration data that is accessed by the software agent.

10 . The method of claim 1 , wherein the module includes an Extended Berkeley Packet Filter (eBPF) module comprising metadata associated with an operation of the eBPF module.

11 . The method of claim 1 , wherein the request for the software agent to collect the second type of workload data is based on a graph comprising a plurality of nodes connected by a plurality of edges, wherein each node of the plurality of nodes represents a logical entity from a type of workload data previously collected by the software agent and each edge of the plurality of edges represents a behavioral relationship between nodes connected by the edge.

12 . The method of claim 1 , wherein the schema allows the dataset to be queried using a query language associated with a data platform.

13 . A method comprising:

one or more processing resources executing a plurality of workloads within a compute environment to generate workload data;

the one or more processing resources detecting a request for a software agent deployed within a compute environment to collect a second type of workload data not previously collected by the software agent and associated with one or more of the plurality of workloads;

the one or more processing resources downloading, a module to collect the second type of workload data from a data platform outside of the compute environment;

the one or more processing resources installing the module in a kernel of an operating system associated with the one or more workloads, the module configured to run in the kernel to generate the second type of workload data; and

the one or more processing resources using the software agent to collect, without modifying source code of the software agent, the second type of workload data from the module, wherein the second type of workload data comprises events generated by the module while the module runs in the kernel, and events associated with a data source that is different than data sources associated with types of workload data collected by the software agent previous to the detecting the request.

14 . The method of claim 13 , further comprising the one or more processing resources using the software agent to transmit the second type of workload data to the data platform in a dataset that uses a same schema as another type of workload data previously collected by the software agent.

15 . The method of claim 14 , wherein an event generated by the module while the module runs in the kernel comprises one or more fields such that content associated with the one or more fields is transmitted in JSON format to an entry within a table that implements the schema.

16 . The method of claim 15 , further comprising the one or more processing resources generating a virtual table that exports each field of the one or more fields in a different column of the virtual table.

17 . The method of claim 13 , further comprising the one or more processing resources using the module to filter the second type of workload data.

18 . A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

executing a plurality of workloads within a compute environment to generate workload data;

detecting an event occurrence based on an analysis of a first type of workload data associated with one or more of the plurality of workloads;

detecting a request for a software agent deployed within the compute environment to collect a second type of workload data associated with the one or more workloads in response to the event occurrence, wherein the second type of data is different than the first type of workload data;

directing the software agent to install a module to collect the second type of workload data in a kernel of an operating system associated with the one or more workloads, the module configured to run in the kernel to generate the second type of workload data; and

receiving the second type of workload data collected by the software agent using the module in a dataset that uses a same schema as the first type of workload data, wherein the second type of workload data comprises events generated by the module while the module runs in the kernel, and events associated with a data source that is different than data sources associated with types of workload data collected by the software agent previous to the detecting the request.

19 . The computer program product of claim 18 , wherein the module is configured to aggregate, based on the events generated by the module, the second type of workload data while the module runs in the kernel.

20 . The computer program product of claim 18 , wherein the module is configured to filter, based on rule data accessed by the module, the second type of workload data while the module runs in the kernel.