How jonscafe/cglens works
cglens is an offline analyzer for cglime container-memory captures. The principal workflow is analyst command → capture loading → shared analysis session → selected plugin → text or JSON report. Plugins recover distinct domains—tasks and ownership, process memory, files and page cache, ELF objects, and sockets—using kernel metadata and sparse-memory access. The graph preserves major README capabilities; relationships for unsampled plugins are documented rather than inferred from their names. Some internal scanner wiring is not shown in excerpts, so uncertain links are omitted.
Main entry points: cglens.py CLI dispatcher · render.py Report rendering · session.py Analysis session · kernel.py Kernel objects
Components 22
Command workflow
- CLI dispatcher
cglens.py
Capture foundation
- Capture image
lens/core/image.py - BTF metadata
lens/core/btf.py - Kernel objects
lens/core/kernel.py - Sparse address spaces
lens/core/layers.py - Analysis session
lens/session.py
Process analysis
- Task discovery
lens/scan/tasks.py - Task ownership
lens/scan/ownership.py - All tasks
lens/plugins/psscan.py - Owned processes
lens/plugins/pslist.py - Process tree
lens/plugins/pstree.py - VMA discovery
lens/scan/vmas.py - Process memory tools
lens/plugins
Memory and files
- ELF recovery
lens/scan/elf.py - ELF analysis
lens/plugins/elfs.py - Inodes and cache
lens/scan/inodes.py - File analysis
lens/plugins
Other analysis and output
- Socket analysis
lens/plugins/sockstat.py - Memory search
lens/plugins/grep.py - Capture information
lens/plugins/info.py - Report rendering
lens/render.py
Other components
- Analyst
Connections 33
- Analyst → CLI dispatcher: runs command
README.md - CLI dispatcher → Capture image: opens capture
cglens.py - CLI dispatcher → Analysis session: creates session
cglens.py - CLI dispatcher → Report rendering: formats result
cglens.py - Capture image → BTF metadata: loads metadata
lens/core/image.py - Kernel objects → BTF metadata: uses type data
lens/core/kernel.py - Kernel objects → Sparse address spaces: reads address spaces
lens/core/kernel.py - Analysis session → Kernel objects: builds kernel view
lens/session.py - Analysis session → Task discovery: scans tasks
lens/session.py - Analysis session → Task ownership: judges ownership
lens/session.py - Analysis session → VMA discovery: finds VMAs
lens/session.py - Analysis session → ELF recovery: names mappings
lens/session.py - Analysis session → Inodes and cache: scans inodes
lens/session.py - All tasks → Report rendering: returns results
lens/plugins/psscan.py - Owned processes → Report rendering: returns results
lens/plugins/pslist.py - Process tree → Report rendering: returns results
lens/plugins/pstree.py - Process memory tools → Report rendering: returns results
README.md - ELF analysis → ELF recovery: uses scanner
lens/plugins/elfs.py - ELF analysis → Report rendering: returns results
lens/plugins/elfs.py - File analysis → Inodes and cache: uses inode scan
lens/plugins/files.py - File analysis → Report rendering: returns results
README.md - Socket analysis → Report rendering: returns results
lens/plugins/sockstat.py - Memory search → Report rendering: returns results
lens/plugins/grep.py - Capture information → Report rendering: returns results
lens/plugins/info.py - CLI dispatcher → All tasks: dispatches plugin
cglens.py - CLI dispatcher → Owned processes: dispatches plugin
cglens.py - CLI dispatcher → Process tree: dispatches plugin
cglens.py - CLI dispatcher → Process memory tools: dispatches analyses
README.md - CLI dispatcher → ELF analysis: dispatches plugin
cglens.py - CLI dispatcher → File analysis: dispatches analyses
README.md - CLI dispatcher → Socket analysis: dispatches plugin
README.md - CLI dispatcher → Memory search: dispatches plugin
README.md - CLI dispatcher → Capture information: dispatches plugin
README.md