[WIP] new(sinsp): implement new PPME_SYSCALL_OPEN event

[Andreagit97]

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area libscap

/area libsinsp

/area tests

Does this PR require a change in the driver versions?

No

What this PR does / why we need it:

This is the first real PR part of the sys_enter/sys_exit initiative #2068.
The suggestion is to review it commit by commit.
The main scope of the PR is to add the new PPME_SYSCALL_OPEN event with its tests in sinsp unit test framework. Apart from this there are some cleanups on enter/exit logic. The idea is to try to divide the new code from the old one where meaningful, using something like if(is_new_event_version()).
I left some todos that we probably need to address at the end of the work, we can probably cleanup and simplify many flows but at the moment i left them as they are to avoid disruption.

Let me know what you think about this :)

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

[github-actions]

Please double check driver/SCHEMA_VERSION file. See versioning.

/hold

[github-actions]

Perf diff from master - unit tests

     3.65%     -1.27%  [.] sinsp_thread_manager::find_thread
     3.24%     +1.14%  [.] sinsp_parser::process_event
     5.53%     +0.80%  [.] sinsp_evt::get_type
     0.68%     +0.68%  [.] sinsp_evt::get_direction
     1.45%     -0.60%  [.] 0x00000000000ea364
     3.92%     -0.52%  [.] gzfile_read
     2.03%     +0.50%  [.] std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release
     0.26%     +0.46%  [.] libsinsp::runc::match_container_id
     1.04%     -0.44%  [.] std::_Hashtable<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::__detail::_Identity, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<true, true, true> >::find
     1.93%     -0.43%  [.] std::_Hashtable<long, std::pair<long const, std::shared_ptr<sinsp_threadinfo> >, std::allocator<std::pair<long const, std::shared_ptr<sinsp_threadinfo> > >, std::__detail::_Select1st, std::equal_to<long>, std::hash<long>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true> >::_M_find_before_node

Heap diff from master - unit tests

peak heap memory consumption: -1.66K
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Heap diff from master - scap file

peak heap memory consumption: 0B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Benchmarks diff from master

Comparing gbench_data.json to /root/actions-runner/_work/libs/libs/build/gbench_data.json
Benchmark                                                         Time             CPU      Time Old      Time New       CPU Old       CPU New
----------------------------------------------------------------------------------------------------------------------------------------------
BM_sinsp_split_mean                                            -0.0491         -0.0491           146           139           146           139
BM_sinsp_split_median                                          -0.0510         -0.0510           146           139           146           139
BM_sinsp_split_stddev                                          +0.4142         +0.4167             1             1             1             1
BM_sinsp_split_cv                                              +0.4873         +0.4899             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_mean                  -0.0512         -0.0512            60            57            60            57
BM_sinsp_concatenate_paths_relative_path_median                -0.0510         -0.0510            60            57            60            57
BM_sinsp_concatenate_paths_relative_path_stddev                +0.6182         +0.6199             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_cv                    +0.7056         +0.7073             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_mean                     -0.0028         -0.0027            25            25            25            25
BM_sinsp_concatenate_paths_empty_path_median                   -0.0015         -0.0014            25            25            25            25
BM_sinsp_concatenate_paths_empty_path_stddev                   +0.0810         +0.0800             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_cv                       +0.0840         +0.0830             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_mean                  -0.0767         -0.0766            62            57            62            57
BM_sinsp_concatenate_paths_absolute_path_median                -0.0839         -0.0838            62            57            62            57
BM_sinsp_concatenate_paths_absolute_path_stddev                -0.7670         -0.7669             1             0             1             0
BM_sinsp_concatenate_paths_absolute_path_cv                    -0.7476         -0.7476             0             0             0             0
BM_sinsp_split_container_image_mean                            +0.0504         +0.0504           373           392           373           392
BM_sinsp_split_container_image_median                          +0.0630         +0.0630           372           396           372           396
BM_sinsp_split_container_image_stddev                          +1.8208         +1.8199             3             8             3             8
BM_sinsp_split_container_image_cv                              +1.6853         +1.6845             0             0             0             0

[codecov]

Codecov Report

Attention: Patch coverage is 83.41232% with 35 lines in your changes missing coverage. Please review.

Project coverage is 75.00%. Comparing base (facfcc3) to head (10bb78a).
Report is 2 commits behind head on master.

Files with missing lines	Patch %	Lines
userspace/libsinsp/event.cpp	20.00%	16 Missing ⚠️
...ce/libsinsp/test/parsers/new_events/parse_open.cpp	92.50%	6 Missing ⚠️
userspace/libsinsp/sinsp_filtercheck_event.cpp	70.58%	5 Missing ⚠️
userspace/libsinsp/event.h	69.23%	4 Missing ⚠️
userspace/libsinsp/parsers.cpp	92.30%	2 Missing ⚠️
userspace/libsinsp/filter_compare.cpp	66.66%	1 Missing ⚠️
userspace/libsinsp/sinsp_filtercheck.cpp	50.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2153      +/-   ##
==========================================
+ Coverage   74.77%   75.00%   +0.22%     
==========================================
  Files         254      256       +2     
  Lines       33505    33636     +131     
  Branches     5748     5742       -6     
==========================================
+ Hits        25053    25227     +174     
+ Misses       8452     8409      -43     

Flag	Coverage Δ
libsinsp	75.00% <83.41%> (+0.22%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

---

🚨 Try these New Features:

• Flaky Tests Detection - Detect and resolve failed and flaky tests

[FedeDP]

/approve

[poiana]

LGTM label has been added.

Git tree hash: 1cdfe973e48e7bf6fe5fd2621c6214b2c340eeeb

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Andreagit97,FedeDP]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[poiana]

New changes are detected. LGTM label has been removed.

[Andreagit97]

Just rebased to fix the CI

[Andreagit97]

/hold
Evaluating other possible approaches

[FedeDP]

Moving to 0.20.0 since we don't have full consensus yet.
/milestone 0.20.0

[Andreagit97]

i will propose something slightly different in the next days