From c9bbf6bed3b4fbf01fcf07be96e83c80d4198acb Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Fri, 3 Jul 2026 17:58:40 +0200 Subject: [PATCH] perf(processor): Remove costly mmaped file queries --- internal/etw/processors/fs_windows.go | 32 --------------------------- 1 file changed, 32 deletions(-) diff --git a/internal/etw/processors/fs_windows.go b/internal/etw/processors/fs_windows.go index 53af418af..4b9104b7f 100644 --- a/internal/etw/processors/fs_windows.go +++ b/internal/etw/processors/fs_windows.go @@ -28,9 +28,7 @@ import ( "github.com/rabbitstack/fibratus/pkg/handle" htypes "github.com/rabbitstack/fibratus/pkg/handle/types" "github.com/rabbitstack/fibratus/pkg/ps" - "github.com/rabbitstack/fibratus/pkg/sys" "github.com/rabbitstack/fibratus/pkg/util/signature" - "github.com/rabbitstack/fibratus/pkg/util/va" "golang.org/x/sys/windows" ) @@ -110,16 +108,6 @@ func (f *fsProcessor) processEvent(e *event.Event) (*event.Event, error) { if fileinfo != nil { totalMapRundownFiles.Add(1) e.AppendParam(params.FilePath, params.Path, fileinfo.Name) - } else { - // if the view of section is backed by the data/image file - // try to get the mapped file name and append it to params - sec := e.Params.MustGetUint32(params.FileViewSectionType) - isMapped := sec != va.SectionPagefile && sec != va.SectionPhysical - if isMapped { - totalMapRundownFiles.Add(1) - addr := e.Params.MustGetUint64(params.FileViewBase) + (e.Params.MustGetUint64(params.FileOffset)) - e.AppendParam(params.FilePath, params.Path, f.getMappedFile(e.PID, addr)) - } } return e, f.psnap.AddMmap(e) @@ -179,17 +167,6 @@ func (f *fsProcessor) processEvent(e *event.Event) (*event.Event, error) { // references fails, we search in the file handles for such file fileinfo := f.findFile(fileKey, fileObject) - // try to resolve mapped file name if not found in internal state - if fileinfo == nil && e.IsMapViewFile() { - sec := e.Params.MustGetUint32(params.FileViewSectionType) - isMapped := sec != va.SectionPagefile && sec != va.SectionPhysical - if isMapped { - totalMapRundownFiles.Add(1) - addr := e.Params.MustGetUint64(params.FileViewBase) + (e.Params.MustGetUint64(params.FileOffset)) - e.AppendParam(params.FilePath, params.Path, f.getMappedFile(e.PID, addr)) - } - } - // ignore object misses that are produced by CloseFile if fileinfo == nil && !e.IsCloseFile() { fileObjectMisses.Add(1) @@ -249,12 +226,3 @@ func (f *fsProcessor) findFile(fileKey, fileObject uint64) *FileInfo { } return nil } - -func (f *fsProcessor) getMappedFile(pid uint32, addr uint64) string { - process, err := windows.OpenProcess(windows.PROCESS_QUERY_INFORMATION, false, pid) - if err != nil { - return "" - } - defer windows.Close(process) - return fs.GetDevMapper().Convert(sys.GetMappedFile(process, uintptr(addr))) -}