PatternFilter

PatternFilter support regex pattern to filter data.

class duetector.filters.pattern.PatternFilter(config: Config | dict[str, Any] | None = None, *args, **kwargs)

Bases: Filter

A Filter support regex pattern to filter data.

There are following config build-in:

• re_exclude_fname: Regex pattern to filter out fname field

• re_exclude_comm: Regex pattern to filter out comm field

• exclude_pid: Filter out pid field

• exclude_uid: Filter out uid field

• exclude_gid: Filter out gid field

Customize exclude is also supported:

• re_exclude_custom: Regex pattern to filter out custom field

• exclude_custom: Filter out custom field

You can change custom to any field you want to filter out.

Config enable_customize_exclude to enable customize exclude, default is True.

Use (?!…) for include pattern:

• re_exclude_custom: ["(?!/proc/)"] will include /proc but exclude others.

Note

• We using python literal to parse config, so you can use environment variable to pass list:

  • Recommended: {PREFIX...}RE_EXCLUDE_FNAME="['/proc*', '/sys*']".

  • Remember to quote the value, otherwise it will be parsed as a expression, e.g. {PREFIX...}RE_EXCLUDE_FNAME=[/proc*] will cause SyntaxError or ValueError. and will fallback to split by comma.

So either use python literal or string split by comma:

• Recommended: {PREFIX...}RE_EXCLUDE_FNAME="['/proc*', '/sys*']"

• It’s OK: {PREFIX...}RE_EXCLUDE_FNAME="/proc*, /sys*"

• Wrong: {PREFIX...}RE_EXCLUDE_FNAME=[/proc*, /sys*], this will be converted to a list of "[/proc*" and "/sys*]".

_re_cache = {}

Cache for re pattern

static _wrap_exclude_list(value: str | list[str]) → set[str]

Wrap exclude list to list if it’s not a list

default_config = {'disabled': False, 'enable_customize_exclude': True, 'exclude_gid': [0], 'exclude_pid': [], 'exclude_uid': [0], 'ignore_current_pid': True, 're_exclude_comm': [], 're_exclude_fname': ['/proc', '/sys', '/lib', '/dev', '/run', '/usr/lib', '/etc/ld.so.cache']}

Default config for PatternFilter

property enable_customize_exclude: bool

If enable customize exclude

filter(data: namedtuple) → namedtuple | None

Filter data, return None to drop data, return data to keep data.

property ignore_current_pid: bool

is_exclude(data: namedtuple, enable_customize_exclude=False) → bool

Customize exclude function, return True to drop data, return False to keep data.

re_exclude(field: str | None, re_list: str | list[str]) → bool

Check if field match any pattern in re_list