apm-agent-java icon indicating copy to clipboard operation
apm-agent-java copied to clipboard

Shortcut agent attach CLI discovery and run-as-user

Open eyalkoren opened this issue 3 years ago • 0 comments

Following up on https://github.com/elastic/apm-server/pull/8590:

  1. If the attacher CLI is invoked with only --include-pid discovery rules, there's no need for discovery and for applying discovery rules, only try to attach to the requests PIDs. If the attacher is not invoked in a --continuous mode, no need to even look whether this PID was encountered before. This avoids a lot of noise related to discovery, especially such that requires actual attachment for extracting data.
  2. Add a --switch-user option to the attacher CLI, which defaults to true, that makes it possible to shortcut the user registry and su route. Even though it is currently protected through isCurrentUser(), this check may not work if we avoid the full JVM discovery (e.g. due to 1, where discovery is not required).

Checklist:

  • [ ] if discovery rules only include --include-pid rules, don't do any discovery, invoke BB attachment for the PID directly
  • [ ] add a --switch-user config option that will default to true and will be set by the APM Server integration to false, in which case the attacher will not do any user registry things and will not invoke a sub attacher process
  • [ ] verify that #2726 is resolved with this

eyalkoren avatar Jul 18 '22 12:07 eyalkoren