Add New CLI: traceectl

[ShohamBit]

Add New CLI: traceectl

Description

Introduce a new client called traceectl for managing Tracee's policies, events, streams, plugins, and diagnostics. This CLI tool will provide structured and user-friendly commands for Tracee users to interact with its various components efficiently.

Design Overview

traceectl will be organized into several management categories: Policy Management, Event Management, Stream Management, Plugin Management, and Additional Commands. Each category will have well-defined subcommands to perform specific actions. The CLI will follow a consistent command structure for ease of use.

---

Event Management

• Commands:
  • traceectl event list: List all available event definitions.
  • traceectl event describe <event_name>: Get detailed information about a specific event.
  • traceectl event enable <event_name>: Enable capturing of a specific event.
  • traceectl event disable <event_name>: Disable capturing of a specific event.

---

Stream Management

• Commands:
  • `traceectl stream : stream events from tracee

---

Additional Commands

• traceectl metrics [--output <format>]: Retrieve Tracee's performance metrics.
• traceectl version: Display the version of traceectl.

---

Usage

traceectl [flags] [options]

Use traceectl <command> --help for more details about a specific command.
Use traceectl options to view global command-line options.

Global Flags

• -h, --help: Help for traceectl.
• -s, --server='': Address and port of the Tracee server.

---

Implementation Plan

1. Design the traceectl CLI framework using Cobra.
2. Implement core commands (Policy Management, Event Management, Stream Management, Plugin Management).
3. Add global flags and logging verbosity support.
4. Create unit tests and mock environments for each command.
5. Document usage examples and integrate --help output for all commands.
6. Test the CLI in real-world scenarios and refine the UX.

---

Tasks

General

• Create the traceectl repository.

Event Management

• Implement event list command.
• Implement event describe command.
• Implement event enable command.
• Implement event disable command.

• NOTE: I have decided to compile event list and describe to 1 command

Stream Management

• Implement stream command.

Additional Commands

• Implement metrics command.
• Implement version command.

---

Additional Notes

This issue tracks the development of traceectl as a central client for interacting with Tracee.

[hanshal101]

Hey @ShohamBit , is this issue still active? If yes I would like to work on this!

[itaysk]

hi @hanshal101 yes this is still active. @ShohamBit perhaps it's best to work in increments: build the basic mechanisms and implement the basic functionality, and then the community can help implement additional areas in parrallel wdyt?

[hanshal101]

hi @hanshal101 yes this is still active. @ShohamBit perhaps it's best to work in increments: build the basic mechanisms and implement the basic functionality, and then the community can help implement additional areas in parrallel wdyt?

Yup, this sounds good. I had one doubt since Shobham had already created a traceectl repo on his account, but it's archived now, so should I create the traceectl repo on mine or is there any repo already created? Also, are there any communication channels like Slack or Discord? It would be great if you could provide me with the link.

[ShohamBit]

hi @hanshal101 yes this is still active. @ShohamBit perhaps it's best to work in increments: build the basic mechanisms and implement the basic functionality, and then the community can help implement additional areas in parrallel wdyt?

I think its a good idea. I already build the fundamentals if traceectl and ther is an open pr about it, waitng for review.

I think that is a greatr idea that the community could help, but first marge the traceectl pr

After that i would make checks on how easy is it to add new features and then i think it will be greate to open for community support

[ShohamBit]

hi @hanshal101 yes this is still active. @ShohamBit perhaps it's best to work in increments: build the basic mechanisms and implement the basic functionality, and then the community can help implement additional areas in parrallel wdyt?

Yup, this sounds good. I had one doubt since Shobham had already created a traceectl repo on his account, but it's archived now, so should I create the traceectl repo on mine or is there any repo already created? Also, are there any communication channels like Slack or Discord? It would be great if you could provide me with the link.

Traceectl repo was the first veraion of traceectl, the thought process was to add traceectl as a submodule but then it vhabed to a new thing inside cmd. It is still a stand alone project but now under tracee/cmd

Traceectl went on cupple of veraion before it reached the current state, you can review it's pr

[hanshal101]

Traceectl went on cupple of veraion

sure, thanks!