
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
github.com/open-telemetry/opentelemetry-collector-contrib/connector/servicegraphconnector
Advanced tools
| Status | |
|---|---|
| Distributions | contrib, k8s |
| Issues | |
| Code coverage | |
| Code Owners | @mapno, @JaredTan95 |
| Exporter Pipeline Type | Receiver Pipeline Type | Stability Level |
|---|---|---|
| traces | metrics | alpha |
The service graphs connector builds a map representing the interrelationships between various services in a system. The connector will analyse trace data and generate metrics describing the relationship between the services. These metrics can be used by data visualization apps (e.g. Grafana) to draw a service graph.
Service graphs are useful for a number of use-cases:
This component is based on Grafana Tempo's service graph processor.
Service graphs work by inspecting traces and looking for spans with parent-children relationship that represent a request. The connector uses the OpenTelemetry semantic conventions to detect a myriad of requests. It currently supports the following requests:
span.kind client and server respectively.span.kind producer and consumer respectively.span.kind=client as well as db.name.Every span that can be paired up to form a request is kept in an in-memory store, until its corresponding pair span is received or the maximum waiting time has passed. When either of these conditions are reached, the request is recorded and removed from the local store.
Each emitted metrics series have the client and server label corresponding with the service doing the request and the service receiving the request.
traces_service_graph_request_total{client="app", server="db", connection_type="database"} 20
TLDR: The connector will try to find spans belonging to requests as seen from the client and the server and will create a metric representing an edge in the graph.
The following metrics are emitted by the connector:
| Metric | Type | Labels | Description |
|---|---|---|---|
| traces_service_graph_request_total | Counter | client, server, connection_type | Total count of requests between two nodes |
| traces_service_graph_request_failed_total | Counter | client, server, connection_type | Total count of failed requests between two nodes |
| traces_service_graph_request_server | Histogram | client, server, connection_type | Number of seconds for a request between two nodes as seen from the server |
| traces_service_graph_request_client | Histogram | client, server, connection_type | Number of seconds for a request between two nodes as seen from the client |
| traces_service_graph_unpaired_spans_total | Counter | client, server, connection_type | Total count of unpaired spans |
| traces_service_graph_dropped_spans_total | Counter | client, server, connection_type | Total count of dropped spans |
Duration is measured both from the client and the server sides.
Possible values for connection_type: unset, messaging_system, or database.
Additional labels can be included using the dimensions configuration option. Those labels will have a prefix to mark where they originate (client or server span kinds).
The client_ prefix relates to the dimensions coming from spans with SPAN_KIND_CLIENT, and the server_ prefix relates to the
dimensions coming from spans with SPAN_KIND_SERVER.
Since the service graph connector has to process both sides of an edge, it needs to process all spans of a trace to function properly. If spans of a trace are spread out over multiple instances, spans are not paired up reliably. A possible solution to this problem is using the load balancing exporter in a layer on front of collector instances running this connector.
Service graph metrics are natively supported by Grafana since v9.0.4. To run it, configure a Tempo data source's 'Service Graphs' by linking to the Prometheus backend where metrics are being sent:
apiVersion: 1
datasources:
# Prometheus backend where metrics are sent
- name: Prometheus
type: prometheus
uid: prometheus
url: <prometheus-url>
jsonData:
httpMethod: GET
version: 1
- name: Tempo
type: tempo
uid: tempo
url: <tempo-url>
jsonData:
httpMethod: GET
serviceMap:
datasourceUid: 'prometheus'
version: 1
The following settings are required:
latency_histogram_buckets: the list of durations defining the latency histogram buckets. Make sure use either latency_histogram_buckets or exponential_histogram_max_size.
[2ms, 4ms, 6ms, 8ms, 10ms, 50ms, 100ms, 200ms, 400ms, 800ms, 1s, 1400ms, 2s, 5s, 10s, 15s]exponential_histogram_max_size: (no default) the maximum number of buckets per positive or negative number range.dimensions: the list of dimensions to add together with the default dimensions defined above.The following settings can be optionally configured:
store: defines the config for the in-memory store used to find requests between services by pairing spans.
ttl: TTL is the time to live for items in the store.
2smax_items: MaxItems is the maximum number of items to keep in the store.
1000cache_loop: the interval at which to clean the cache.
1mstore_expiration_loop: the time to expire old entries from the store periodically.
2svirtual_node_peer_attributes: the list of attributes, ordered by priority, whose presence in a client span will result in the creation of a virtual server node. An empty list disables virtual node creation.
[peer.service, db.name, db.system]virtual_node_extra_label: adds an extra label virtual_node with an optional value of client or server, indicating which node is the uninstrumented one.
falsemetrics_flush_interval: the interval at which metrics are flushed to the exporter.
60smetrics_timestamp_offset: the offset to subtract from metric timestamps. If set to a positive duration, metric timestamps will be set to (current time - offset), effectively shifting metrics to appear as if they were generated in the past.
0database_name_attributes: the list of attribute names used to identify the database name from span attributes. The attributes are tried in order, selecting the first match.
[db.name]receivers:
otlp:
protocols:
grpc:
connectors:
servicegraph:
latency_histogram_buckets: [100ms, 250ms, 1s, 5s, 10s]
dimensions:
- dimension-1
- dimension-2
store:
ttl: 1s
max_items: 10
exporters:
prometheus/servicegraph:
endpoint: localhost:9090
namespace: servicegraph
service:
pipelines:
traces:
receivers: [otlp]
exporters: [servicegraph]
metrics/servicegraph:
receivers: [servicegraph]
exporters: [prometheus/servicegraph]
receivers:
otlp:
protocols:
grpc:
connectors:
servicegraph:
dimensions:
- db.system
- messaging.system
virtual_node_peer_attributes:
- db.name
- db.system
- messaging.system
- peer.service
virtual_node_extra_label: true
exporters:
prometheus/servicegraph:
endpoint: localhost:9090
namespace: servicegraph
service:
pipelines:
traces:
receivers: [otlp]
exporters: [servicegraph]
metrics/servicegraph:
receivers: [servicegraph]
exporters: [prometheus/servicegraph]
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.