cleanup(sinsp): remove child list from threadinfos by gnosek · Pull Request #3133 · falcosecurity/libs

gnosek · 2026-10-09T13:15:28Z

What type of PR is this?

/kind feature

/kind cleanup

Any specific area of the project related to this PR?

/area libsinsp

/area tests

Does this PR require a change in the driver versions?

No.

What this PR does / why we need it:

TL;DR:

Rework how parent-child relations are stored in the thread table. Make the common case faster, some edge cases slower, but most importantly, enable the thread table to be used from multiple threads without cross-object atomic transactions (sequential individually atomic updates to single threadinfos are now enough). This does not make the thread table thread safe (far from it), but it makes the process significantly simpler (to implement, and more importantly, to understand).

The whole story from Claude:

This PR changes how libsinsp stores the process tree. Before, each thread kept a list of its
children, and each child kept the tid of its parent. When a process died, sinsp moved every
child to the reaper, one by one, and it changed both ends of each parent-child edge. This cost
O(N) for a process with N children. A write that must change two objects at the same time also
blocks a multithreaded thread table.

Now only the child stores the link, and nothing keeps a list of children:

The parent link of a process lives on its thread group (thread_group_info). It is a pointer
to the group of the parent, plus the tid of the thread that forked. sinsp resolves the link
when it writes it, so an ancestor walk does not look up a tid on every hop.
Every group has a rank, set before the group is published, that never changes. The rank is
the rank of the parent plus one. A link can only go to a group with a lower rank, so the links
can never form a loop. The test needs only the two groups that the link joins, and it needs
no lock. A link that does not go down in rank is refused, and sinsp logs it at debug level.
Only bad or missing data asks for such a link, for example a loop in the ppids from /proc,
a tid reused after a lost exit, or a parent whose own ancestry is unknown.
When the last thread of a process goes, its group becomes a tombstone (a dead group that stays
while a child links to it). The reaper replaces the parent link of the tombstone. Sometimes
the procexit event names no reaper. Then a reader that reaches the tombstone searches for the
nearest live subreaper or init. The search stays in the same pid namespace.
A clone or an execve writes the calling process anyway. These two events now also link the
process past its dead parents, which frees the tombstones in between.
A process from /proc whose parent is not in the table keeps the tid of its parent instead
of 0. If the table has the parent by its next clone or execve, that event links it to the
parent.

The ancestor walk now follows the links with one cursor. Because the links cannot form a loop,
the walk needs no loop detection, and debug builds assert that the chain ends.

The first commit also fixes the CMake condition that kept the scap-file test suite from being
built, so these tests run again.

Benchmarks:

The base is commit 3, which adds the benchmark: master, the scap-suite fix, and the ptid
accessors. Both arms are Release builds with the same compiler flags. The process_tree
benchmark counts user-space instructions around each operation only. The table gives the median
of 3 interleaved rounds on one pinned core.

Benchmark	Base (insn)	This PR (insn)	Change
Exit of a process with 0 children	2612	2491	-5%
Exit of a process with 10 children	5388	2428	-55%
Exit of a process with 100 children	28778	2370	-92%
Exit of a process with 1000 children	261011	2372	-99%
Full ancestor walk, 4 deep	628	370	-41%
Full ancestor walk, 16 deep	2284	1270	-44%
Full ancestor walk, 64 deep	8908	4870	-45%
`proc.aname[n]`, n = 1 to 8	122 to 535	116 to 557	-5% to +4%
Walk, 16 deep, after 8 ancestors died (reaper known)	1180	750	-36%
Walk, 16 deep, after 15 ancestors died (reaper known)	214	295	+38%
Walk, 16 deep, after 15 ancestors died (reaper unknown)	214	1060	+395%
Walk after a clone or execve, past 0 to 15 dead ancestors	263 to 2419	185 to 1310	-10% to -46%
Clone after 0 to 15 dead ancestors	53007 to 67194	54395 to 69226	+1% to +3%
Execve after 0 to 15 dead ancestors	9248 to 23451	9882 to 24657	+2% to +10%

The walk through 15 dead ancestors is slower because master moved the children to the reaper at
each exit, which made the chain shorter. This PR keeps the tombstones until the next clone or
execve of the child. If the reaper is unknown, each read also searches for it again. Only a
process that runs no clone or execve after its ancestors die pays this cost, for example a
long-running daemon.

A clone or an execve costs 300 to 2000 more instructions. When ancestors are dead, part of that
is the reaper search and the release of the tombstones, which master paid at the exit. A cost of
300 to 550 instructions also occurs with no dead ancestors, on the first event of a new
inspector. It first appears in commit 8. A profile spreads it over unrelated functions, so it
looks like a change in the state of the allocator or the code layout, not a cost per event. A
repeated execve on the same tree differs by 7 instructions per event.

Replay of real captures through sinsp (a harness that is not part of this PR), in instructions
per event from a two-point slope. Each value reproduces to 0.1 instructions per event across
3 rounds. Both arms pass the same number of events through each filter.

Capture	Benchmark	Base	This PR	Change
kexec_x86	parse	935.0	928.6	-0.7%
kexec_x86	parse + filter with an ancestor walk	1608.9	1580.2	-1.8%
kexec_arm64	parse	1126.1	1119.1	-0.6%
kexec_arm64	parse + filter with an ancestor walk	1839.2	1808.3	-1.7%

The benchmarks outside the process tree (plugin_field, utils) measure CPU time and change by
less than the noise of the machine.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

The order of the commits follows the design: each commit builds and passes the unit tests. Commits
8 to 16 change one property at a time, so you can review them one by one.

The ptid field of the thread table is now read-only for a thread in a thread group. The reason
is that the parent link belongs to the group. A plugin that writes ptid on such a thread gets
SS_PLUGIN_FAILURE. A plugin can still write ptid on a new entry before it adds the entry to
the table.

sinsp logs each refused link and each late link at debug level, with the pid, the tid of the
parent, and for a refused link the two ranks. These log lines replace the removed warning for a
loop in the tree. They are for diagnosis, for example when a process has a short ancestry. They
are not metrics, because an operator cannot act on a count of them. Their causes are dropped
events, races in the /proc scan, and missing ancestry, and the drop counters already report
the first one.

Behavioral differences

None of this should ever surface during a normal run, but the behavior in some edge cases (like missing the parent in the thread table) might be different.

Parent missing from the table. A process from /proc whose parent is not in the table got ptid 0 on master, and its ancestry stayed empty for good. Now it keeps the real ppid, so proc.ppid shows that value. A later clone or execve of the process links it to the parent if the table has the parent by then, and from then on the ancestry is complete. The same holds when a clone event names a parent that sinsp does not know. One risk is new: if the parent's pid is reused before the link happens, the process links to the unrelated new process with that pid, and its ancestry is wrong. On master it would have had none.

No reaper in the procexit event. On master, sinsp searched for the nearest subreaper or init when the process exited, and wrote the result into each child. Now the dead parent stays as a tombstone, and each read searches above it. The search stops at the same places as master: the nearest live subreaper, or init, within the same pid namespace. Two things differ. A subreaper that is set after the death now counts. And until the child's next clone or execve, the answer can change if subreapers above it appear or exit, because nothing stores it.

Reaper sent by the kernel. sinsp still uses it, unless the kernel's reaper ranks above the dying process. That can happen when a tid was reused after an exit that sinsp never saw. Master accepted such a reaper even when it created a loop in the tree. Now the link is refused, and readers search for a reaper instead.

Loops in the tree. On master, a loop could form, for example from a ppid loop in /proc or a bad reaper. The ancestor walk then detected it, stopped, set parent_loop_detected(), and logged the warning "Loop in parent thread state detected" once per process. Now a loop cannot form, because sinsp refuses the link that would close it. The walk stops at the process whose link was refused, which is not always where master stopped. The warning is gone. A DEBUG log line now records each refused link, and another records each late link.

Parent of a process, not of a thread. The parent is now stored once per thread group. If the thread that forked a child exits, readers get the first live thread of the same parentprocess, which is the thread that master also chose. Invalid threads (unknown pid, no thread group) now have no ancestry at all. On master, sinsp followed their own ptid.

Writing the ptid. A plugin write to the ptid field of a thread in a thread group now fails with SS_PLUGIN_FAILURE, and set_ptid() throws in C++. On master, the write changed the parent. A write to a new entry before it joins the
table still works.

reaper_tid field. The kernel sends reaper_tid=0 for childless processes. On master, if sinsp believes the process has no children, it leaves the reaper_tid untouched (stays at -1). In this branch, we don't do this check (it's no longer cheap) and always overwrite reaper_tid with what the kernel sent, so childless processes will see their reaper tid change from -1 to 0.

Memory. A dead process with live children stays in memory as a tombstone, a dead thread group record, until the children link past it (on their next clone or execve) or exit. A tombstone is invisible through the thread table and the
group table.

Performance. The exit of a process with N children no longer touches the children, so it costs O(1) and follows pointers instead of looking up a tid at each hop. A walk through many dead ancestors gets slower until the child's next clone or execve, and much slower when the reaper is unknown, because each read searches again. This sounds bad but is an edge case of an edge case (we'd need a deep tree of dead parents, which doesn't really happen in the real world as you generally fork twice, not 20 times, to daemonize, and we'd need to have no reaper information from the driver)

API removals. The child list, the loop methods, and the DEFAULT_EXPIRED_CHILDREN_THRESHOLD macro are removed, m_ptid is private, and get_thread_list() has a new return type. These are code changes, not behavior, and the "action required" release notes list them.

Does this PR introduce a user-facing change?:

action required: libsinsp no longer keeps a list of children per thread. sinsp_threadinfo::m_children, m_not_expired_children, add_child(), clean_expired_children(), assign_children_to_reaper(), parent_loop_detected(), set_parent_loop_detected() and report_thread_loop() are removed, and so is the DEFAULT_EXPIRED_CHILDREN_THRESHOLD macro. To find the children of a thread, scan the thread table for the threads whose sinsp_thread_manager::get_parent_thread() is that thread.
action required: sinsp_threadinfo::m_ptid is private. Use get_ptid() to read it, and set_ptid() to write it before the thread joins a thread group. After that, set_ptid() throws sinsp_exception, and a plugin write to the `ptid` field of the thread table fails.
action required: thread_group_info::get_thread_list() returns std::list<thread_group_info::thread_ref> instead of std::list<std::weak_ptr<sinsp_threadinfo>>. thread_ref has expired() and lock(), so most callers compile unchanged. The new borrow() returns the raw pointer without taking a reference.

🤖 Generated with Claude Code
🧠 Reviewed and edited by a protein-based proxy

The build of the suite depended on `TARGET unit-test-libsinsp`. CMake evaluates that condition before it defines the target, so it never built the scap-file tests. Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>

A later commit computes the parent instead of storing it on every thread. Code outside the thread must not touch the field, so the field becomes private. The behavior does not change. Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>

The benchmarks measure these operations: - A walk up the ancestors (proc.aname, proc.aname[n]), also through dead ancestors. - The removal of a process that has children. - A clone or execve by a process whose ancestors died, and then a walk from that process. Each operation has its own instruction counter, so the counts do not include setup. Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>

…he tree These tests record the current behavior. If the procexit event gives no reaper, the children of a dead process go to the nearest subreaper above it. If there is no subreaper, they go to init. The search does not go past the pid namespace of the process. An ancestor walk stops on a loop. Chains 300 deep walk to init. When their subreapers die from the bottom up, the chains reparent to init. This is true with or without the reapers from the kernel. A ppid loop of 300 from /proc also stops the walk. Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>

The ancestor walks, the reaper search, and the parent filterchecks now find the parent through get_parent_thread(). A later change to how sinsp finds a parent then touches only this one function. The behavior does not change. Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>

ASSERT_THREAD_CHILDREN now scans the thread table for the threads whose parent is the given thread. It no longer reads the child list of the parent, and it no longer tests the size of that list (`children_num`). For a thread that is not in the table, the test looks at the parent link of the thread instead. Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>

All threads of a process have the same parent, so the thread group now stores the parent tid. The thread that creates the group sets it. A thread without a group uses its own value. Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>

… when it is written Before, the parent of a process was a tid, and an ancestor walk looked it up on every hop. Now the group holds a pointer to the group of the parent, with the tid of the thread that forked. The writer resolves the link when it writes it. A reader takes that thread from the thread list of the group. If the thread is gone, the reader takes the first live thread of the group. Every link goes down in rank, so the links never form a cycle. The rank of a group is set before the group is published, and it never changes. The rank is the rank of the parent plus one, 0 without a parent, and a high value when the parent is unknown. A link to a group with the same or a higher rank is refused. Only bad data asks for such a link, for example a loop in the /proc ppids. The test needs only the two groups that the link joins. A refused link keeps the tid without a pointer, as an unknown parent does, and walks stop there. A debug log records each refused link. The /proc scan can reach a child before its parent. In that case, the scan creates the group of the parent first. A ppid loop can lead back to the child, so the scan first publishes the group of the child, with a rank that nothing can link to. The ptid of a thread is writable only until the thread joins a group. After that, the `ptid` field is read-only. A thread without a group has no parent to follow. Thus, the e2e walk test gives its threads a pid, and sinsp now refuses the loops of that test. Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>

The links cannot form a loop, so the walk needs no second cursor. Debug builds assert that the chain ends. parent_loop_detected() can only return false now, so it is removed. Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>

…ist of children Before, every thread kept a list of its children. When a thread died, sinsp rewrote its children one by one to the reaper. It also updated the list whenever a child went away. The lists are gone. Now a link, an exit, or the removal of a process each writes only that process. When the last thread of a group goes, the group leaves the group table and becomes a tombstone. A tombstone stays alive while a child links to it. Its reaper replaces its parent link, unless that link goes up in rank (for example, a tid reused after a lost exit). The reaper is the one from the kernel, or the one that the search finds. While the group lives, the children of a removed thread go to the first live thread of the group. A main thread stays in the table while its group lives, so sinsp marks the removed threads. The procexit parser keeps the reaper that the kernel sends. The kernel sends one only for a thread with children. The tests of assign_children_to_reaper are removed. A new test makes sure that a tombstone lives exactly as long as its children. Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>

If the procexit event names no reaper, the tombstone keeps its parent link. A reader that reaches the tombstone searches above it for the nearest live subreaper or init, in its pid namespace. An exit no longer walks the tree, and the search writes nothing. A subreaper that is set after the death now counts. If sinsp refused the reaper from the kernel for a tombstone, the children of the tombstone get the reaper that the search finds. Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>

…ng a reference Before, a read of a thread from the list locked a weak_ptr and released it at once. That cost two atomic read-modify-writes, which was most of the cost of resolving a parent. The thread table owns the threads, so an entry now keeps the raw pointer. The entry returns the pointer after it calls expired(). Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>

Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>

…execs A reader follows every tombstone above a process, and a tombstone lives while a child links to it. Clone and execve write the calling process anyway. Now they also link it straight to where its dead parents lead, and this frees the tombstones in between. Other events cost nothing. The search for an unknown reaper runs once, here, and sinsp links the result. The store goes down in rank. If the link of the process itself changed in the meantime, sinsp drops the store. Two tests use a debug-only hook to drive a relink into that window. Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>

…d parents when it dies A tombstone with an unknown reaper keeps its parent link for the search. If that parent is dead too, the dying process links past it, as clone and execve do. This frees the tombstone of the parent. The change covers parents that die first. If a child dies first, its own next clone or execve links it past them. Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>

Before, a process from /proc whose parent was not in the table got ptid 0. Now it keeps the tid of the parent. If the table has that parent by the next clone or execve of the process, that event links the process to it. The process ranks above any known ancestry, so the link goes down in rank. The exception is a parent whose ancestry is also unknown. sinsp refuses that link and does not try it again. A reused tid is linked as if it were the parent. A debug log records each late link. Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>

At a procexit, the tool printed the children that it said sinsp moved to a new reaper. sinsp no longer moves children. Their links stay, and the dead group becomes a tombstone. The tool now shows what sinsp stores and does: - After a clone, an execve, or a procexit, the chain of parent links, one group per hop. Each hop shows the rank, the tid that the link names, and if the group is a tombstone. The thread that a reader gets comes last. - At a procexit, the reaper that the kernel sent, and the processes that link to the group of the thread. - After sinsp removes the thread on the next event, if the group was freed or stays as a tombstone, and the link of the tombstone. - The debug log lines about refused and late parent links, as they happen. Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>

poiana · 2026-10-09T13:15:34Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: gnosek

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [gnosek]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

codecov · 2026-10-09T13:25:28Z

Codecov Report

❌ Patch coverage is 86.83002% with 86 lines in your changes missing coverage. Please review.
✅ Project coverage is 79.61%. Comparing base (8510814) to head (42cac75).

Files with missing lines	Patch %	Lines
userspace/libsinsp/sinsp_debug/sinsp_debug.cpp	0.00%	81 Missing ⚠️
userspace/libsinsp/test/thread_table.ut.cpp	99.09%	3 Missing ⚠️
userspace/libsinsp/sinsp_filtercheck_thread.cpp	75.00%	1 Missing ⚠️
userspace/libsinsp/thread_manager.cpp	98.87%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3133      +/-   ##
==========================================
+ Coverage   77.46%   79.61%   +2.14%     
==========================================
  Files         304      309       +5     
  Lines       34989    36273    +1284     
  Branches     5194     5212      +18     
==========================================
+ Hits        27105    28878    +1773     
+ Misses       7884     7395     -489

Flag	Coverage Δ
libsinsp	`79.61% <86.83%> (+2.14%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

github-actions · 2026-10-09T13:35:41Z

Perf diff from master - unit tests

    23.86%    -13.74%  [.] sinsp_threadinfo::get_main_thread()
    14.26%     -7.64%  [.] std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release()
    12.08%     -7.50%  [.] std::__shared_count<(__gnu_cxx::_Lock_policy)2>::__shared_count(std::__weak_count<(__gnu_cxx::_Lock_policy)2> const&, std::nothrow_t)
    11.59%     -6.57%  [.] thread_group_info::get_first_thread() const
     0.15%     +5.22%  [.] sinsp::next(sinsp_evt**)
     8.60%     -4.82%  [.] sinsp_thread_manager::create_thread_dependencies(std::shared_ptr<sinsp_threadinfo> const&)
     8.26%     -4.19%  [.] sinsp_threadinfo::get_fd_table() const
     0.10%     +3.82%  [.] sinsp_parser::reset(sinsp_evt&) const
     4.35%     -2.68%  [.] std::__shared_count<(__gnu_cxx::_Lock_policy)2>::_M_get_use_count() const
     0.02%     +2.20%  [.] std::__weak_count<(__gnu_cxx::_Lock_policy)2>::_M_get_use_count() const

Heap diff from master - unit tests

peak heap memory consumption: 523.28K
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Heap diff from master - scap file

peak heap memory consumption: 12.31K
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Benchmarks diff from master

Comparing gbench_data.json to /root/actions-runner/_work/libs/libs/build/gbench_data.json
Benchmark                                                                             Time             CPU      Time Old      Time New       CPU Old       CPU New
------------------------------------------------------------------------------------------------------------------------------------------------------------------
BM_plugin_field_floor_mean                                                         +0.0046         +0.0047            99            99            99            99
BM_plugin_field_floor_median                                                       +0.0057         +0.0058            99            99            99            99
BM_plugin_field_floor_stddev                                                       +0.1792         +0.1313             0             1             0             0
BM_plugin_field_floor_cv                                                           +0.1738         +0.1260             0             0             0             0
BM_plugin_field_raw_pid_mean                                                       +0.0008         +0.0010            99            99            99            99
BM_plugin_field_raw_pid_median                                                     +0.0030         +0.0031            99            99            99            99
BM_plugin_field_raw_pid_stddev                                                     -0.0791         -0.0603             1             1             1             1
BM_plugin_field_raw_pid_cv                                                         -0.0798         -0.0612             0             0             0             0
BM_plugin_field_raw_name_mean                                                      -0.0038         -0.0039           102           102           102           102
BM_plugin_field_raw_name_median                                                    -0.0035         -0.0042           102           102           102           102
BM_plugin_field_raw_name_stddev                                                    +0.1400         +0.1421             0             1             0             1
BM_plugin_field_raw_name_cv                                                        +0.1444         +0.1466             0             0             0             0
BM_plugin_field_evtnum_mean                                                        +0.0291         +0.0291           113           116           112           116
BM_plugin_field_evtnum_median                                                      +0.0301         +0.0306           113           116           112           116
BM_plugin_field_evtnum_stddev                                                      +0.4741         +0.4671             0             1             0             1
BM_plugin_field_evtnum_cv                                                          +0.4325         +0.4256             0             0             0             0
BM_plugin_field_proc_pid_mean                                                      +0.0141         +0.0142           116           118           116           118
BM_plugin_field_proc_pid_median                                                    +0.0146         +0.0148           116           118           116           118
BM_plugin_field_proc_pid_stddev                                                    +0.0754         +0.0700             1             1             1             1
BM_plugin_field_proc_pid_cv                                                        +0.0604         +0.0551             0             0             0             0
BM_plugin_field_proc_name_mean                                                     +0.0059         +0.0059           120           121           120           121
BM_plugin_field_proc_name_median                                                   +0.0073         +0.0074           120           121           120           121
BM_plugin_field_proc_name_stddev                                                   +0.0593         +0.0641             1             1             1             1
BM_plugin_field_proc_name_cv                                                       +0.0532         +0.0578             0             0             0             0
BM_plugin_field_proc_bool_mean                                                     +0.0119         +0.0120           117           118           116           118
BM_plugin_field_proc_bool_median                                                   +0.0125         +0.0130           116           118           116           118
BM_plugin_field_proc_bool_stddev                                                   -0.0751         -0.0757             1             1             1             1
BM_plugin_field_proc_bool_cv                                                       -0.0859         -0.0866             0             0             0             0
BM_plugin_field_proc_fspath_mean                                                   -0.0108         -0.0106           115           114           115           114
BM_plugin_field_proc_fspath_median                                                 -0.0104         -0.0104           115           114           115           114
BM_plugin_field_proc_fspath_stddev                                                 -0.1475         -0.1345             1             0             1             0
BM_plugin_field_proc_fspath_cv                                                     -0.1383         -0.1252             0             0             0             0
BM_plugin_field_rawarg_int_mean                                                    -0.0318         -0.0319           118           115           118           115
BM_plugin_field_rawarg_int_median                                                  -0.0313         -0.0312           118           115           118           115
BM_plugin_field_rawarg_int_stddev                                                  -0.1687         -0.1928             1             0             1             0
BM_plugin_field_rawarg_int_cv                                                      -0.1414         -0.1662             0             0             0             0
BM_plugin_field_proc_glob_mean                                                     -0.0015         -0.0015           133           133           133           133
BM_plugin_field_proc_glob_median                                                   -0.0002         -0.0005           133           133           133           133
BM_plugin_field_proc_glob_stddev                                                   +0.1019         +0.1095             0             0             0             0
BM_plugin_field_proc_glob_cv                                                       +0.1035         +0.1111             0             0             0             0
BM_plugin_field_proc_icontains_mean                                                -0.0044         -0.0046           135           134           135           134
BM_plugin_field_proc_icontains_median                                              -0.0054         -0.0054           135           134           134           134
BM_plugin_field_proc_icontains_stddev                                              +0.0557         +0.0546             1             1             1             1
BM_plugin_field_proc_icontains_cv                                                  +0.0604         +0.0595             0             0             0             0
BM_plugin_field_proc_in_mean                                                       +0.0060         +0.0061           124           125           124           125
BM_plugin_field_proc_in_median                                                     +0.0064         +0.0066           124           125           124           124
BM_plugin_field_proc_in_stddev                                                     -0.0868         -0.1115             1             1             1             1
BM_plugin_field_proc_in_cv                                                         -0.0922         -0.1169             0             0             0             0
BM_plugin_field_proc_uid_mean                                                      -0.0087         -0.0086           133           132           133           132
BM_plugin_field_proc_uid_median                                                    -0.0069         -0.0069           133           132           133           132
BM_plugin_field_proc_uid_stddev                                                    +0.0531         +0.0559             1             1             1             1
BM_plugin_field_proc_uid_cv                                                        +0.0623         +0.0650             0             0             0             0
BM_plugin_field_proc_pid_x2_mean                                                   +0.0092         +0.0093           121           122           121           122
BM_plugin_field_proc_pid_x2_median                                                 +0.0100         +0.0101           121           122           121           122
BM_plugin_field_proc_pid_x2_stddev                                                 +0.2551         +0.2548             1             1             1             1
BM_plugin_field_proc_pid_x2_cv                                                     +0.2437         +0.2433             0             0             0             0
BM_plugin_field_proc_pid_x4_mean                                                   +0.0075         +0.0076           126           127           126           127
BM_plugin_field_proc_pid_x4_median                                                 +0.0061         +0.0063           126           127           126           127
BM_plugin_field_proc_pid_x4_stddev                                                 -0.0575         -0.0735             1             0             1             0
BM_plugin_field_proc_pid_x4_cv                                                     -0.0645         -0.0805             0             0             0             0
BM_plugin_field_proc_pid_x8_mean                                                   +0.0046         +0.0048           137           137           137           137
BM_plugin_field_proc_pid_x8_median                                                 +0.0046         +0.0047           137           137           137           137
BM_plugin_field_proc_pid_x8_stddev                                                 -0.1737         -0.2145             1             0             1             0
BM_plugin_field_proc_pid_x8_cv                                                     -0.1775         -0.2182             0             0             0             0
BM_plugin_field_proc_pid_ors_x8_mean                                               +0.0119         +0.0118           141           142           141           142
BM_plugin_field_proc_pid_ors_x8_median                                             +0.0116         +0.0115           141           142           141           142
BM_plugin_field_proc_pid_ors_x8_stddev                                             -0.3913         -0.4020             1             1             1             1
BM_plugin_field_proc_pid_ors_x8_cv                                                 -0.3984         -0.4090             0             0             0             0
BM_plugin_field_proc_pid_deep_x6_mean                                              -0.0174         -0.0175           141           139           141           139
BM_plugin_field_proc_pid_deep_x6_median                                            -0.0176         -0.0176           141           139           141           139
BM_plugin_field_proc_pid_deep_x6_stddev                                            -0.0338         -0.0456             1             1             1             1
BM_plugin_field_proc_pid_deep_x6_cv                                                -0.0167         -0.0286             0             0             0             0
BM_plugin_field_proc_pid_nots_x4_mean                                              +0.0105         +0.0105           128           129           128           129
BM_plugin_field_proc_pid_nots_x4_median                                            +0.0082         +0.0083           128           129           128           129
BM_plugin_field_proc_pid_nots_x4_stddev                                            +0.2245         +0.2313             1             1             1             1
BM_plugin_field_proc_pid_nots_x4_cv                                                +0.2118         +0.2185             0             0             0             0
BM_plugin_field_proc_pid_group_x4_mean                                             +0.0076         +0.0076           126           127           126           127
BM_plugin_field_proc_pid_group_x4_median                                           +0.0097         +0.0097           126           127           126           127
BM_plugin_field_proc_pid_group_x4_stddev                                           +0.2786         +0.2907             0             1             0             1
BM_plugin_field_proc_pid_group_x4_cv                                               +0.2691         +0.2810             0             0             0             0
BM_plugin_field_proc_mixed_x4_mean                                                 +0.0004         +0.0005           148           148           148           148
BM_plugin_field_proc_mixed_x4_median                                               +0.0015         +0.0015           148           148           148           148
BM_plugin_field_proc_mixed_x4_stddev                                               -0.4306         -0.4259             1             0             1             0
BM_plugin_field_proc_mixed_x4_cv                                                   -0.4308         -0.4262             0             0             0             0
BM_plugin_field_v3_pid_mean                                                        +0.0040         +0.0041           152           152           152           152
BM_plugin_field_v3_pid_median                                                      +0.0047         +0.0048           152           152           152           152
BM_plugin_field_v3_pid_stddev                                                      +1.0227         +0.8983             0             1             0             1
BM_plugin_field_v3_pid_cv                                                          +1.0146         +0.8905             0             0             0             0
BM_plugin_field_v3_name_mean                                                       +0.0138         +0.0139           156           158           156           158
BM_plugin_field_v3_name_median                                                     +0.0144         +0.0145           156           158           156           158
BM_plugin_field_v3_name_stddev                                                     +0.7580         +0.7284             0             1             0             1
BM_plugin_field_v3_name_cv                                                         +0.7340         +0.7048             0             0             0             0
BM_plugin_field_v3_const_mean                                                      +0.0023         +0.0021           135           135           135           135
BM_plugin_field_v3_const_median                                                    +0.0018         +0.0013           135           135           135           135
BM_plugin_field_v3_const_stddev                                                    -0.1956         -0.1710             1             0             1             0
BM_plugin_field_v3_const_cv                                                        -0.1974         -0.1727             0             0             0             0
BM_plugin_field_v3_ip_mean                                                         +0.0066         +0.0067           134           135           134           135
BM_plugin_field_v3_ip_median                                                       +0.0065         +0.0067           134           135           134           135
BM_plugin_field_v3_ip_stddev                                                       +0.1208         +0.1097             1             1             1             1
BM_plugin_field_v3_ip_cv                                                           +0.1135         +0.1024             0             0             0             0
BM_plugin_field_v3_net_mean                                                        +0.0028         +0.0030           125           126           125           126
BM_plugin_field_v3_net_median                                                      +0.0026         +0.0028           125           126           125           126
BM_plugin_field_v3_net_stddev                                                      +0.0980         +0.0614             0             1             0             1
BM_plugin_field_v3_net_cv                                                          +0.0948         +0.0582             0             0             0             0
BM_sinsp_split_mean                                                                +0.0032         +0.0031           245           246           245           246
BM_sinsp_split_median                                                              +0.0052         +0.0051           244           245           244           245
BM_sinsp_split_stddev                                                              +0.0247         +0.0311             3             3             3             3
BM_sinsp_split_cv                                                                  +0.0214         +0.0279             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_mean                                      -0.1270         -0.1270            64            56            64            56
BM_sinsp_concatenate_paths_relative_path_median                                    -0.1237         -0.1238            63            56            63            55
BM_sinsp_concatenate_paths_relative_path_stddev                                    -0.5665         -0.5659             2             1             2             1
BM_sinsp_concatenate_paths_relative_path_cv                                        -0.5035         -0.5028             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_mean                                         -0.1144         -0.1144            47            42            47            42
BM_sinsp_concatenate_paths_empty_path_median                                       -0.1066         -0.1067            47            42            47            42
BM_sinsp_concatenate_paths_empty_path_stddev                                       +2.8188         +2.8305             0             1             0             1
BM_sinsp_concatenate_paths_empty_path_cv                                           +3.3118         +3.3252             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_mean                                      -0.1346         -0.1346            67            58            67            58
BM_sinsp_concatenate_paths_absolute_path_median                                    -0.1335         -0.1335            67            58            67            58
BM_sinsp_concatenate_paths_absolute_path_stddev                                    -0.4507         -0.4519             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_cv                                        -0.3652         -0.3666             0             0             0             0
BM_sinsp_utf8_sanitize_fast_path_ascii_short_mean                                  -0.0025         -0.0024            18            18            18            17
BM_sinsp_utf8_sanitize_fast_path_ascii_short_median                                -0.0032         -0.0031            18            17            18            17
BM_sinsp_utf8_sanitize_fast_path_ascii_short_stddev                                +0.2380         +0.2254             0             0             0             0
BM_sinsp_utf8_sanitize_fast_path_ascii_short_cv                                    +0.2411         +0.2284             0             0             0             0
BM_sinsp_utf8_sanitize_fast_path_ascii_long_mean                                   +0.0081         +0.0081            67            68            67            68
BM_sinsp_utf8_sanitize_fast_path_ascii_long_median                                 +0.0089         +0.0090            67            68            67            68
BM_sinsp_utf8_sanitize_fast_path_ascii_long_stddev                                 -0.5175         -0.5174             0             0             0             0
BM_sinsp_utf8_sanitize_fast_path_ascii_long_cv                                     -0.5214         -0.5213             0             0             0             0
BM_sinsp_utf8_sanitize_fast_path_multibyte_short_mean                              +0.1254         +0.1255            13            14            13            14
BM_sinsp_utf8_sanitize_fast_path_multibyte_short_median                            +0.1422         +0.1423            12            14            12            14
BM_sinsp_utf8_sanitize_fast_path_multibyte_short_stddev                            -0.7129         -0.7126             0             0             0             0
BM_sinsp_utf8_sanitize_fast_path_multibyte_short_cv                                -0.7449         -0.7446             0             0             0             0
BM_sinsp_utf8_sanitize_fast_path_multibyte_long_mean                               +0.2308         +0.2307          3954          4867          3953          4865
BM_sinsp_utf8_sanitize_fast_path_multibyte_long_median                             +0.2306         +0.2304          3954          4866          3953          4864
BM_sinsp_utf8_sanitize_fast_path_multibyte_long_stddev                             +2.7132         +2.8424             1             4             1             4
BM_sinsp_utf8_sanitize_fast_path_multibyte_long_cv                                 +2.0170         +2.1220             0             0             0             0
BM_sinsp_utf8_sanitize_fast_path_mixed_long_mean                                   +0.1339         +0.1339          1769          2006          1769          2006
BM_sinsp_utf8_sanitize_fast_path_mixed_long_median                                 +0.1382         +0.1386          1763          2006          1762          2006
BM_sinsp_utf8_sanitize_fast_path_mixed_long_stddev                                 -0.9562         -0.9607            27             1            27             1
BM_sinsp_utf8_sanitize_fast_path_mixed_long_cv                                     -0.9613         -0.9654             0             0             0             0
BM_sinsp_utf8_sanitize_slow_path_c1_controls_long_alloc_mean                       +0.2624         +0.2624          1152          1455          1152          1454
BM_sinsp_utf8_sanitize_slow_path_c1_controls_long_alloc_median                     +0.2623         +0.2623          1152          1455          1152          1454
BM_sinsp_utf8_sanitize_slow_path_c1_controls_long_alloc_stddev                     -0.0511         -0.1463             1             1             1             1
BM_sinsp_utf8_sanitize_slow_path_c1_controls_long_alloc_cv                         -0.2484         -0.3237             0             0             0             0
BM_sinsp_utf8_sanitize_slow_path_c1_controls_long_noalloc_mean                     +0.1597         +0.1598          1149          1333          1149          1333
BM_sinsp_utf8_sanitize_slow_path_c1_controls_long_noalloc_median                   +0.2640         +0.2641          1149          1452          1148          1451
BM_sinsp_utf8_sanitize_slow_path_c1_controls_long_noalloc_stddev                  +81.5688        +83.4322             2           150             2           150
BM_sinsp_utf8_sanitize_slow_path_c1_controls_long_noalloc_cv                      +70.1972        +71.7984             0             0             0             0
BM_sinsp_utf8_sanitize_slow_path_sparse_invalid_long_alloc_mean                    -0.0661         -0.0661           246           230           246           230
BM_sinsp_utf8_sanitize_slow_path_sparse_invalid_long_alloc_median                  -0.0616         -0.0614           245           230           244           229
BM_sinsp_utf8_sanitize_slow_path_sparse_invalid_long_alloc_stddev                  -0.8534         -0.8529            14             2            14             2
BM_sinsp_utf8_sanitize_slow_path_sparse_invalid_long_alloc_cv                      -0.8430         -0.8425             0             0             0             0
BM_sinsp_utf8_sanitize_slow_path_sparse_invalid_long_noalloc_mean                  -0.0182         -0.0182           139           136           139           136
BM_sinsp_utf8_sanitize_slow_path_sparse_invalid_long_noalloc_median                +0.0153         +0.0153           134           136           134           136
BM_sinsp_utf8_sanitize_slow_path_sparse_invalid_long_noalloc_stddev                -0.9356         -0.9354            16             1            16             1
BM_sinsp_utf8_sanitize_slow_path_sparse_invalid_long_noalloc_cv                    -0.9344         -0.9342             0             0             0             0
BM_sinsp_utf8_sanitize_slow_path_all_invalid_long_alloc_mean                       -0.0283         -0.0283         12257         11911         12253         11907
BM_sinsp_utf8_sanitize_slow_path_all_invalid_long_alloc_median                     -0.0276         -0.0278         12251         11913         12248         11908
BM_sinsp_utf8_sanitize_slow_path_all_invalid_long_alloc_stddev                     -0.5404         -0.5692            17             8            17             7
BM_sinsp_utf8_sanitize_slow_path_all_invalid_long_alloc_cv                         -0.5270         -0.5567             0             0             0             0
BM_sinsp_utf8_sanitize_slow_path_all_invalid_long_noalloc_mean                     -0.0469         -0.0468         12291         11715         12286         11711
BM_sinsp_utf8_sanitize_slow_path_all_invalid_long_noalloc_median                   -0.0524         -0.0524         12358         11711         12353         11706
BM_sinsp_utf8_sanitize_slow_path_all_invalid_long_noalloc_stddev                   -0.9568         -0.9570           286            12           285            12
BM_sinsp_utf8_sanitize_slow_path_all_invalid_long_noalloc_cv                       -0.9547         -0.9549             0             0             0             0
BM_sinsp_concatenate_paths_long_normalizing_path_mean                              -0.3142         -0.3142           976           669           976           669
BM_sinsp_concatenate_paths_long_normalizing_path_median                            -0.3146         -0.3145           976           669           976           669
BM_sinsp_concatenate_paths_long_normalizing_path_stddev                            -0.6923         -0.6828             2             1             2             1
BM_sinsp_concatenate_paths_long_normalizing_path_cv                                -0.5513         -0.5374             0             0             0             0
BM_sinsp_concatenate_paths_too_long_path_mean                                      +0.0025         +0.0025          3236          3244          3235          3243
BM_sinsp_concatenate_paths_too_long_path_median                                    +0.0022         +0.0022          3236          3243          3235          3242
BM_sinsp_concatenate_paths_too_long_path_stddev                                    +0.4410         +0.3578             2             3             2             3
BM_sinsp_concatenate_paths_too_long_path_cv                                        +0.4374         +0.3544             0             0             0             0
BM_sinsp_concatenate_paths_beyond_scratch_mean                                     -0.0192         -0.0192            47            46            47            46
BM_sinsp_concatenate_paths_beyond_scratch_median                                   -0.0186         -0.0185            47            46            47            46
BM_sinsp_concatenate_paths_beyond_scratch_stddev                                   +8.9446         +8.9242             0             0             0             0
BM_sinsp_concatenate_paths_beyond_scratch_cv                                       +9.1391         +9.1184             0             0             0             0

gnosek added 17 commits October 8, 2026 12:11

fix(test): run the scap-file suite again

4f84d4d

The build of the suite depended on `TARGET unit-test-libsinsp`. CMake evaluates that condition before it defines the target, so it never built the scap-file tests. Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>

test(sinsp): spell the unknown reaper's name right

0b5928f

Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>

github-project-automation Bot added this to Falco Roadmap Oct 9, 2026

poiana added release-note-action-required kind/feature New feature or request kind/cleanup labels Oct 9, 2026

poiana requested a review from hbrueckner October 9, 2026 13:15

poiana requested a review from terror96 October 9, 2026 13:15

poiana added dco-signoff: yes area/libsinsp approved area/tests size/XXL labels Oct 9, 2026

gnosek mentioned this pull request Oct 9, 2026

[TRACKING] Multithreading support #3134

Open

Navigation Menu

Repository navigation

cleanup(sinsp): remove child list from threadinfos - #3133

cleanup(sinsp): remove child list from threadinfos#3133
gnosek wants to merge 17 commits into
falcosecurity:masterfrom
gnosek:remove-child-list

gnosek commented Oct 9, 2026

Uh oh!

poiana commented Oct 9, 2026

Uh oh!

codecov Bot commented Oct 9, 2026

Uh oh!

github-actions Bot commented Oct 9, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

gnosek commented Oct 9, 2026

Uh oh!

poiana commented Oct 9, 2026

Uh oh!

codecov Bot commented Oct 9, 2026

Codecov Report

Uh oh!

github-actions Bot commented Oct 9, 2026

Perf diff from master - unit tests

Heap diff from master - unit tests

Heap diff from master - scap file

Benchmarks diff from master

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants