Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor: Rename event parameters to fields #4398

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

yanivagman
Copy link
Collaborator

1. Explain what the PR does

This PR renames the parameters field in event definitions to fields. This change reflects the evolving nature of Tracee, which now supports various event types beyond just syscalls.

The term "fields" more accurately describes the structured data within events, aligning with the concept of event schemas and the data section in the new event structure.

This renaming also avoids future confusion with the planned introduction of "event parameters," which will be configurable settings for modifying event behavior.

2. Explain how to test it

3. Other comments

This commit renames the `parameters` field in event definitions to `fields`.
This change reflects the evolving nature of Tracee, which now supports various
event types beyond just syscalls.

The term "fields" more accurately describes the structured data within events,
aligning with the concept of event schemas and the `data` section in the new
event structure.

This renaming also avoids future confusion with the planned introduction of
"event parameters," which will be configurable settings for modifying event
behavior.
@NDStrahilevitz
Copy link
Collaborator

What's the logical difference between the fields section and the data section? fields represents the metadata for the concrete data found in an event? If so, why not just align the names?

@yanivagman
Copy link
Collaborator Author

What's the logical difference between the fields section and the data section? fields represents the metadata for the concrete data found in an event? If so, why not just align the names?

I agree that clear terminology is crucial. Here's why I chose 'fields' for the event definition and 'data' for the output:

data in Output: This represents the actual event payload – the concrete values captured at runtime. It's the raw information associated with the event, like the arguments passed to a syscall or the contents of a network packet.

fields in Definition: This acts as the metadata or schema for the event. It defines the structure, types, and possible values within the data section.

While the complete term might be "data fields," using "data" for the output and "fields" for the definition provides contextual clarity and avoids redundancy.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants