#!/usr/bin/env python3
# analyze_sampled_leaks.py

def analyze_sampled_output(output_file, sample_rate):
    """Analyze BCC memleak sampled output with rate adjustment."""
    
    leaks = []
    current_leak = None
    
    with open(output_file, 'r') as f:
        for line in f:
            # Parse leak summary line
            if re.match(r'^\d+ bytes in \d+ allocations', line):
                if current_leak:
                    leaks.append(current_leak)
                
                parts = line.split()
                current_leak = {
                    'sampled_bytes': int(parts[0]),
                    'estimated_bytes': int(parts[0]) * sample_rate,
                    'sampled_count': int(parts[3]),
                    'estimated_count': int(parts[3]) * sample_rate,
                    'stack_trace': []
                }
            
            # Collect stack trace lines
            elif current_leak and line.strip().startswith('0x'):
                current_leak['stack_trace'].append(line.strip())
    
    return leaks

def prioritize_leaks(leaks):
    """Prioritize leaks by estimated total size."""
    return sorted(leaks, key=lambda x: x['estimated_bytes'], reverse=True)

#!/usr/bin/env python3
# memleak_sampled_analyzer.py

import subprocess
import time
import json
import re
from typing import Dict, List, Optional
from dataclasses import dataclass

@dataclass
class LeakInfo:
    bytes_leaked: int
    allocation_count: int
    estimated_total_bytes: int
    estimated_total_count: int
    stack_trace: List[str]
    avg_allocation_size: int

class MemleakSampledAnalyzer:
    def __init__(self, sample_rate: int = 1000, min_size: int = 1024):
        self.sample_rate = sample_rate
        self.min_size = min_size
        self.duration_limit = 300  # 5 minutes maximum
        
    def run_analysis(self, pid: int, duration: int = 300) -> List[LeakInfo]:
        """Run sampled memory leak analysis on target process."""
        
        if duration > self.duration_limit:
            duration = self.duration_limit
            
        cmd = [
            'sudo', '/usr/share/bcc/tools/memleak',
            '-p', str(pid),
            '-s', str(self.sample_rate),
            '-z', str(self.min_size),
            '-o', '1000',  # 1 second minimum age
            '--combined-only'  # Use kernel statistics for performance
        ]
        
        try:
            # Run with timeout protection
            result = subprocess.run(
                cmd,
                timeout=duration,
                capture_output=True,
                text=True,
                check=False
            )
            
            return self._parse_output(result.stdout)
            
        except subprocess.TimeoutExpired:
            print(f"Sampling completed after {duration} seconds")
            return []
        except Exception as e:
            print(f"Error running memleak: {e}")
            return []
    
    def _parse_output(self, output: str) -> List[LeakInfo]:
        """Parse memleak output and extract leak information."""
        leaks = []
        lines = output.split('\n')
        
        i = 0
        while i < len(lines):
            line = lines[i]
            
            # Look for leak summary lines
            match = re.match(r'^(\d+) bytes in (\d+) allocations from stack', line)
            if match:
                sampled_bytes = int(match.group(1))
                sampled_count = int(match.group(2))
                
                # Estimate actual totals based on sampling rate
                estimated_bytes = sampled_bytes * self.sample_rate
                estimated_count = sampled_count * self.sample_rate
                
                # Collect stack trace
                stack_trace = []
                i += 1
                while i < len(lines) and lines[i].strip().startswith('0x'):
                    stack_trace.append(lines[i].strip())
                    i += 1
                
                leaks.append(LeakInfo(
                    bytes_leaked=sampled_bytes,
                    allocation_count=sampled_count,
                    estimated_total_bytes=estimated_bytes,
                    estimated_total_count=estimated_count,
                    stack_trace=stack_trace,
                    avg_allocation_size=estimated_bytes // max(estimated_count, 1)
                ))
                continue
            
            i += 1
        
        return sorted(leaks, key=lambda x: x.estimated_total_bytes, reverse=True)
    
    def generate_alert(self, leaks: List[LeakInfo], threshold_mb: int = 10) -> Optional[Dict]:
        """Generate alert if significant leaks detected."""
        
        if not leaks:
            return None
            
        total_estimated_leaked = sum(leak.estimated_total_bytes for leak in leaks)
        
        if total_estimated_leaked < threshold_mb * 1024 * 1024:
            return None
            
        return {
            'severity': 'high' if total_estimated_leaked > 100*1024*1024 else 'medium',
            'total_leaked_mb': total_estimated_leaked / (1024 * 1024),
            'leak_sites': len(leaks),
            'top_leak': {
                'estimated_bytes': leaks[0].estimated_total_bytes,
                'stack_preview': leaks[0].stack_trace[:3]
            },
            'sampling_info': {
                'sample_rate': self.sample_rate,
                'accuracy_note': f'Estimates based on 1/{self.sample_rate} sampling'
            }
        }

# Usage example
if __name__ == "__main__":
    analyzer = MemleakSampledAnalyzer(sample_rate=500, min_size=1024)
    pid = 12345  # Target process
    
    print(f"Starting sampled leak analysis for PID {pid}")
    leaks = analyzer.run_analysis(pid, duration=300)
    
    if leaks:
        print(f"Found {len(leaks)} potential leak sites")
        for i, leak in enumerate(leaks[:5], 1):
            print(f"{i}. Estimated {leak.estimated_total_bytes:,} bytes "
                  f"in {leak.estimated_total_count:,} allocations")
    
    alert = analyzer.generate_alert(leaks)
    if alert:
        print("ALERT:", json.dumps(alert, indent=2))

# systemagent_memleak_integration.py

class SystemAgentMemleakIntegration:
    def __init__(self, config):
        self.config = config
        self.analyzer = MemleakSampledAnalyzer(
            sample_rate=config.get('sample_rate', 1000),
            min_size=config.get('min_size', 1024)
        )
    
    def should_trigger_sampling(self, process_metrics: Dict) -> bool:
        """Determine if memory leak sampling should be triggered."""
        
        # Memory growth rate check
        growth_rate = process_metrics.get('memory_growth_mb_per_hour', 0)
        if growth_rate > 50:  # >50MB/hour growth
            return True
            
        # RSS increase threshold
        rss_increase = process_metrics.get('rss_increase_mb', 0)
        if rss_increase > 100:  # >100MB increase
            return True
            
        # OOM risk assessment
        oom_risk = process_metrics.get('oom_risk_score', 0)
        if oom_risk > 0.7:  # High OOM risk
            return True
            
        return False
    
    def execute_sampling(self, pid: int) -> Dict:
        """Execute memory leak sampling and return results."""
        
        start_time = time.time()
        
        # Adjust sampling rate based on allocation frequency
        alloc_freq = self._estimate_allocation_frequency(pid)
        sample_rate = self._calculate_optimal_sampling_rate(alloc_freq)
        
        self.analyzer.sample_rate = sample_rate
        
        leaks = self.analyzer.run_analysis(pid, duration=300)
        alert = self.analyzer.generate_alert(leaks)
        
        return {
            'timestamp': start_time,
            'pid': pid,
            'sample_rate': sample_rate,
            'duration': time.time() - start_time,
            'leaks_detected': len(leaks),
            'alert': alert,
            'raw_leaks': [leak.__dict__ for leak in leaks[:10]]  # Top 10
        }

def calculate_optimal_sampling_rate(allocation_frequency: int) -> int:
    """Calculate optimal sampling rate based on allocation patterns."""
    
    # Base sampling rates by allocation frequency
    if allocation_frequency < 1000:      # <1K allocs/sec
        return 100    # 1% sampling
    elif allocation_frequency < 10000:   # <10K allocs/sec
        return 500    # 0.2% sampling
    elif allocation_frequency < 50000:   # <50K allocs/sec
        return 1000   # 0.1% sampling
    else:                               # >50K allocs/sec
        return 2000   # 0.05% sampling

# overhead_monitor.py

class OverheadMonitor:
    def __init__(self):
        self.baseline_metrics = {}
        self.tracing_metrics = {}
    
    def capture_baseline(self, pid: int):
        """Capture performance metrics before tracing."""
        self.baseline_metrics = {
            'cpu_usage': self._get_cpu_usage(pid),
            'memory_usage': self._get_memory_usage(pid),
            'response_time': self._get_response_time(pid)
        }
    
    def monitor_overhead(self, pid: int) -> Dict:
        """Monitor overhead during tracing."""
        current_metrics = {
            'cpu_usage': self._get_cpu_usage(pid),
            'memory_usage': self._get_memory_usage(pid),
            'response_time': self._get_response_time(pid)
        }
        
        overhead = {}
        for metric, current_value in current_metrics.items():
            baseline_value = self.baseline_metrics.get(metric, 0)
            if baseline_value > 0:
                overhead[f'{metric}_overhead_percent'] = \
                    ((current_value - baseline_value) / baseline_value) * 100
        
        return overhead
    
    def should_terminate_early(self, overhead: Dict) -> bool:
        """Determine if tracing should be terminated due to high overhead."""
        
        # Terminate if CPU overhead exceeds 50%
        if overhead.get('cpu_usage_overhead_percent', 0) > 50:
            return True
            
        # Terminate if response time degrades >100%
        if overhead.get('response_time_overhead_percent', 0) > 100:
            return True
            
        return False