Simplest option to get Protobuf events streamed over TCP

[francescom-zenity]

Hey all,
First of all, thanks for this great project. I'm new to it but I believe it's fitting very well my needs.

Now my question:
According to both stable & dev docs:

• https://aquasecurity.github.io/tracee/v0.24/docs/outputs/output-formats/
• https://aquasecurity.github.io/tracee/dev/docs/outputs/event-structure/
  I couldn't find a way to just have Tracee send its internal protobuf events to some location (either as JSON or also as binary serialized protobufs).

I then tried to connect to the grpc server exposed by Tracee itself.
Here's my relevant config line:

server:
    http-address: "127.0.0.1:3000"
    grpc-address: "tcp:2000"     # note the use of 'tcp:PORT' 
    metrics: true
    healthz: true

and here's what happens:

sudo tracee --config /etc/tracee.yaml
panic: send on closed channel

goroutine 26 [running]:
github.com/aquasecurity/tracee/pkg/ebpf/heartbeat.SendPulse(...)
	/tracee/pkg/ebpf/heartbeat/heartbeat.go:81
github.com/aquasecurity/tracee/pkg/ebpf/controlplane.(*Controller).registerBuiltinSignals.func6(0x44?, {0xd3c445?, 0xc002bd7aa0?, 0x0?})
	/tracee/pkg/ebpf/controlplane/controller.go:233 +0x25
github.com/aquasecurity/tracee/pkg/ebpf/controlplane.(*Controller).ProcessSignal(0xc002e11420?, 0xc002e11420)
	/tracee/pkg/ebpf/controlplane/controller.go:160 +0x4c
github.com/aquasecurity/tracee/pkg/ebpf/controlplane.(*Controller).Run(0xc00059e460, {0x31f2068?, 0xc001e46300?})
	/tracee/pkg/ebpf/controlplane/controller.go:107 +0x2c5
created by github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).Run in goroutine 1
	/tracee/pkg/ebpf/tracee.go:1638 +0x2e5

(If I change the server.grpc-address back to a local Unix socket, Tracee starts just fine)

Any suggestion?

thanks

[francescom-zenity]

Wait forget about that. I realized the crash I was getting was due to another instance of Tracee already running via SystemD.
The "tcp:PORT" syntax is indeed working.
I'm now fighting with "grpcurl" which errors out somehow:

~/tracee$ grpcurl -plaintext   -proto api/v1beta1/tracee.proto -proto api/v1beta1/event.proto -proto api/v1beta1/definition.proto  192.168.101.10:2000   TraceeService.GetVersion
Error invoking method "TraceeService.GetVersion": target server does not expose service "TraceeService"

[francescom-zenity]

Ok never mind I figured it out. THis works:

grpcurl -v -plaintext   -proto api/v1beta1/tracee.proto -proto api/v1beta1/event.proto -proto api/v1beta1/definition.proto  192.168.101.10:2000   tracee.v1beta1.TraceeService.GetVersion

Resolved method descriptor:
rpc GetVersion ( .tracee.v1beta1.GetVersionRequest ) returns ( .tracee.v1beta1.GetVersionResponse );

Request metadata to send:
(empty)

Response headers received:
content-type: application/grpc

Response contents:
{
  "version": "v0.24.1"
}

Response trailers received:
(empty)
Sent 0 requests and received 1 response

[geyslan]

@francescom-zenity that's great! 👍🏻