Repository navigation
Backlog predicate #78
Description
A predicate that can show a stacktrace or store a number of events up to a certain point:
# defaults
class Backlog:
def __init__(self, filter, action=CallPrinter, size=None, stack=30):
self.filter = filter
self.action = action
self.queue = collections.deque(maxlen=size) if size else None
self.stack = stack
....Handling could be:
-
Backlog.__call__(event)predicate returns True ifself.filter(event)returns True -
If
sizeis given it stores detached in a deque with that size -
the first time[1]
self.filter(event)returns True:- if there's a self.queue it calls self.action for each event from it up to a self.stack depth
- otherwise it creates events from each frame from
sys._getframe()up to self.stack depth and passes them to self.action
-
otherwise add events in self.queue
[1] similar to how From predicate works
Activity
ionelmc commentedon Mar 25, 2020
expression, action=SomePrinter)Backlog(function="foobar", size=10, action=CodePrinter)Backlog(function="foobar", size=10, action=CodePrinter).filter(stdlib=False)Backlog(function="foobar", stack=10, size=0, action=CodePrinter).filter(stdlib=False)Backlog(function="foobar", kind="line", stack=10, size=0, action=CodePrinter)Backlog(function="foobar", stack=10, size=20, action=CallPrinter)Backlog(function="foobar")tracewould inject the main actions if they aren't already specified.Or(Q(function="test123"), Backlog(function="foobar"))tracewould need to smart enough to be able to examine the whole predicate tree.~Backlog(function="foobar")Backlog(Not(Q(function="foobar")))as it doesn't make sense to negate backlog on the outside (eg: hunter would display events from backlog 2 times - undesirable).Perhaps
stack=10, size=100, action=CallPrintercould be default.ionelmc commentedon Mar 25, 2020
There is a problem when creating fake events... the
Event.__init__wants a tracer (to fill depth/calls). Perhaps make it optional and add options for depth/calls. Value for "calls" in fake events is very problematic - nothing in hunter uses them now so maybe "-1" is a safe value. Value for "depth" should be computed by applying a stack delta to the dump-trigger event's depth.