feat(output)!: remove relative-time

Author: NDStrahilevitz

builder/entrypoint.sh

@@ -35,7 +35,6 @@ run_tracee() {
         --capabilities drop=$CAPABILITIES_DROP \
         --output=json \
         --output=option:parse-arguments \
-        --output=option:relative-time \
         --events signatures,container_create,container_remove
     fi
 

deploy/helm/tracee/templates/tracee-config.yaml

@@ -36,7 +36,6 @@ data:
             parse-arguments: {{ .Values.config.output.options.parseArguments }}
             stack-addresses: {{ .Values.config.output.options.stackAddresses }}
             exec-env: {{ .Values.config.output.options.execEnv }}
-            relative-time: {{ .Values.config.output.options.relativeTime }}
             exec-hash: {{ .Values.config.output.options.execHash }}
             sort-events: {{ .Values.config.output.options.sortEvents }}
         {{- with .Values.config.output.webhook }}

deploy/helm/tracee/values.yaml

@@ -101,7 +101,6 @@ config:
       parseArguments: true
       stackAddresses: false
       execEnv: false
-      relativeTime: true
       execHash: dev-inode
       sortEvents: false
     # uncomment config.output.webhook to enable a single webhook

deploy/kubernetes/tracee/tracee.yaml

@@ -55,7 +55,6 @@ data:
             parse-arguments: true
             stack-addresses: false
             exec-env: false
-            relative-time: true
             exec-hash: dev-inode
             sort-events: false
 ---

docs/docs/flags/output.1.md

@@ -11,7 +11,7 @@ tracee **\-\-output** - Control how and where output is printed
 
 ## SYNOPSIS
 
-tracee **\-\-output** <format[:file,...]\> | gotemplate=template[:file,...] | forward:url | webhook:url | option:{stack-addresses,exec-env,relative-time,exec-hash[={inode,dev-inode,digest-inode}],parse-arguments,parse-arguments-fds,sort-events} ...
+tracee **\-\-output** <format[:file,...]\> | gotemplate=template[:file,...] | forward:url | webhook:url | option:{stack-addresses,exec-env,exec-hash[={inode,dev-inode,digest-inode}],parse-arguments,parse-arguments-fds,sort-events} ...
 
 
 ## DESCRIPTION
@@ -40,11 +40,10 @@ Webhook options:
 
 Other options:
 
-- **option:{stack-addresses,exec-env,relative-time,exec-hash,parse-arguments,sort-events}**: Augment output according to the given options. The default is none. Multiple options can be specified, separated by commas.
+- **option:{stack-addresses,exec-env,exec-hash,parse-arguments,sort-events}**: Augment output according to the given options. The default is none. Multiple options can be specified, separated by commas.
 
   - **stack-addresses**: Include stack memory addresses for each event.
   - **exec-env**: When tracing execve/execveat, show the environment variables that were used for execution.
-  - **relative-time**: Use relative timestamp instead of wall timestamp for events.
   - **exec-hash**: When tracing some file related events, show the file hash (sha256).
     - Affected events: *sched_process_exec*, *shared_object_loaded*
     - **inode** option recalculates the file hash if the inode's creation time (ctime) differs, which can occur in different namespaces even for identical inode. This option is performant, but not recommended and should only be used if container enrichment can't be enabled for digest-inode, and if performance is preferred over correctness.

docs/docs/install/config/index.md

@@ -129,7 +129,6 @@ output:
         none: false
         stack-addresses: true
         exec-env: false
-        relative-time: true
         exec-hash: dev-inode
         parse-arguments: true
         sort-events: false

docs/docs/outputs/output-options.md

@@ -51,17 +51,7 @@ Available options:
             exec-hash: dev-inode
     ```
 
-5. **relative-time**
-
-    The `relative-time` output option enables relative timestamp instead of wall timestamp for events.
-
-    ```
-    output:
-        options:
-            relative-time: true
-    ```
-
-6. **sort-events**
+5. **sort-events**
 
     This makes it possible to sort the events as they happened. Especially in systems where Tracee tracks lots of events, it can happen that they are received unordered. More information is provided in the [deep-dive](../deep-dive/ordering-events.md) section of the documentation.
 

docs/docs/policies/usage/cli.md

@@ -91,7 +91,6 @@ output:
         none: false
         stack-addresses: false
         exec-env: true
-        relative-time: true
         exec-hash: dev-inode
         parse-arguments: true
         parse-arguments-fds: true

docs/man/output.1

@@ -7,7 +7,7 @@ tracee \f[B]\-\-output\f[R] \- Control how and where output is printed
 tracee \f[B]\-\-output\f[R] <format[:file,\&...]> |
 gotemplate=template[:file,\&...]
 | forward:url | webhook:url |
-option:{stack\-addresses,exec\-env,relative\-time,exec\-hash[={inode,dev\-inode,digest\-inode}],parse\-arguments,parse\-arguments\-fds,sort\-events}
+option:{stack\-addresses,exec\-env,exec\-hash[={inode,dev\-inode,digest\-inode}],parse\-arguments,parse\-arguments\-fds,sort\-events}
 \&...
 .SS DESCRIPTION
 The \f[B]\-\-output\f[R] flag allows you to control how and where the
@@ -49,7 +49,7 @@ webhook URL.
 .PP
 Other options:
 .IP \[bu] 2
-\f[B]option:{stack\-addresses,exec\-env,relative\-time,exec\-hash,parse\-arguments,sort\-events}\f[R]:
+\f[B]option:{stack\-addresses,exec\-env,exec\-hash,parse\-arguments,sort\-events}\f[R]:
 Augment output according to the given options.
 The default is none.
 Multiple options can be specified, separated by commas.
@@ -61,9 +61,6 @@ event.
 \f[B]exec\-env\f[R]: When tracing execve/execveat, show the environment
 variables that were used for execution.
 .IP \[bu] 2
-\f[B]relative\-time\f[R]: Use relative timestamp instead of wall
-timestamp for events.
-.IP \[bu] 2
 \f[B]exec\-hash\f[R]: When tracing some file related events, show the
 file hash (sha256).
 .RS 2

examples/config/global_config.yaml

@@ -121,7 +121,6 @@ output:
     #     none: false
     #     stack-addresses: true
     #     exec-env: false
-    #     relative-time: true
     #     exec-hash: dev-inode
     #     parse-arguments: true
     #     sort-events: false