Function TestProcessCallstackProcsTTL

pkg/symbolize/symbolizer_test.go:416–464

(t *testing.T)

}

func TestProcessCallstackProcsTTL(t *testing.T) {
	log.SetLevel(log.DebugLevel)
	r := new(MockResolver)
	c := &config.Config{}

	psnap := new(ps.SnapshotterMock)

	opts := uint32(sys.SymUndname | sys.SymCaseInsensitive | sys.SymAutoPublics | sys.SymOmapFindNearest | sys.SymDeferredLoads)
	r.On("Initialize", mock.Anything, opts).Return(nil)
	r.On("LoadModule", windows.CurrentProcess(), mock.Anything).Return(nil)
	r.On("GetModuleName", mock.Anything, mock.Anything).Return("C:\\WINDOWS\\System32\\KERNEL32.DLL")
	r.On("GetSymbolNameAndOffset", mock.Anything, mock.Anything).Return("CreateProcessW", 0x54)
	r.On("Cleanup", mock.Anything)

	s := NewSymbolizer(r, psnap, c, false)
	require.NotNil(t, s)
	defer s.Close()

	n := 10
	for n > 0 {
		e := &event.Event{
			Type:      event.CreateProcess,
			Tid:       2484,
			PID:       1232,
			CPU:       1,
			Seq:       2,
			Name:      "CreatedProcess",
			Timestamp: time.Now().Add(time.Millisecond * time.Duration(n)),
			Category:  event.Process,
			Host:      "archrabbit",
			Params: event.Params{
				params.ProcessParentID:     {Name: params.ProcessParentID, Type: params.PID, Value: (uint32(os.Getpid()))},
				params.ProcessRealParentID: {Name: params.ProcessRealParentID, Type: params.PID, Value: (uint32(os.Getpid()))},
				params.Callstack:           {Name: params.Callstack, Type: params.Slice, Value: []va.Address{0x7ffb5c1d0396, 0x7ffb5d8e61f4, 0x7ffb3138592e, 0x7ffb313853b2, 0x2638e59e0a5}},
			},
		}
		_, _ = s.ProcessEvent(e)
		n--
		time.Sleep(time.Millisecond * time.Duration(rand.Intn(15)*n))
	}
	// process should be present
	assert.Equal(t, 1, s.procsSize())

	time.Sleep(time.Millisecond * 2250)

	// evicted
	r.AssertNumberOfCalls(t, "Cleanup", 1)
	assert.Equal(t, 0, s.procsSize())
}