eBPF process (collector improvements) (#11643)
thiagoftsm committed
Oct 18, 2021 at 11:08 UTC
075fd5c82137a56ac698a5096c9e8e69c8b380ce
6 files changed
+315
-89
collectors/ebpf.plugin/ebpf_apps.h
+3
-4
@@ -357,12 +357,11 @@ typedef struct ebpf_process_stat {
357
//Counter
358
uint32_t exit_call;
359
uint32_t release_call;
360
- uint32_t fork_call;
361
- uint32_t clone_call;
360
+ uint32_t create_process;
361
+ uint32_t create_thread;
362
363
//Counter
364
- uint32_t fork_err;
365
- uint32_t clone_err;
364
+ uint32_t task_err;
365
366
uint8_t removeme;
367
} ebpf_process_stat_t;
collectors/ebpf.plugin/ebpf_process.c
+247
-50
@@ -30,6 +30,14 @@ static ebpf_local_maps_t process_maps[] = {{.name = "tbl_pid_stats", .internal_i
30
.type = NETDATA_EBPF_MAP_CONTROLLER,
31
.map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED}};
32
33
+char *tracepoint_sched_type = { "sched" } ;
34
+char *tracepoint_sched_process_exit = { "sched_process_exit" };
35
+char *tracepoint_sched_process_exec = { "sched_process_exec" };
36
+char *tracepoint_sched_process_fork = { "sched_process_fork" };
37
+static int was_sched_process_exit_enabled = 0;
38
+static int was_sched_process_exec_enabled = 0;
39
+static int was_sched_process_fork_enabled = 0;
40
+
41
static netdata_idx_t *process_hash_values = NULL;
42
static netdata_syscall_stat_t process_aggregated_data[NETDATA_KEY_PUBLISH_PROCESS_END];
43
static netdata_publish_syscall_t process_publish_aggregated[NETDATA_KEY_PUBLISH_PROCESS_END];
@@ -115,14 +123,14 @@ static void ebpf_process_send_data(ebpf_module_t *em)
123
netdata_publish_vfs_common_t pvc;
124
ebpf_update_global_publish(process_publish_aggregated, &pvc, process_aggregated_data);
125
118
- write_count_chart(NETDATA_EXIT_SYSCALL, NETDATA_EBPF_FAMILY,
126
+ write_count_chart(NETDATA_EXIT_SYSCALL, NETDATA_EBPF_SYSTEM_GROUP,
127
&process_publish_aggregated[NETDATA_KEY_PUBLISH_PROCESS_EXIT], 2);
120
- write_count_chart(NETDATA_PROCESS_SYSCALL, NETDATA_EBPF_FAMILY,
128
+ write_count_chart(NETDATA_PROCESS_SYSCALL, NETDATA_EBPF_SYSTEM_GROUP,
129
&process_publish_aggregated[NETDATA_KEY_PUBLISH_PROCESS_FORK], 2);
130
123
- write_status_chart(NETDATA_EBPF_FAMILY, &pvc);
131
+ write_status_chart(NETDATA_EBPF_SYSTEM_GROUP, &pvc);
132
if (em->mode < MODE_ENTRY) {
125
- write_err_chart(NETDATA_PROCESS_ERROR_NAME, NETDATA_EBPF_FAMILY,
133
+ write_err_chart(NETDATA_PROCESS_ERROR_NAME, NETDATA_EBPF_SYSTEM_GROUP,
134
&process_publish_aggregated[NETDATA_KEY_PUBLISH_PROCESS_FORK], 2);
135
}
136
}
@@ -181,7 +189,7 @@ void ebpf_process_remove_pids()
189
*
190
* @param root the target list.
191
*/
184
-void ebpf_process_send_apps_data(struct target *root)
192
+void ebpf_process_send_apps_data(struct target *root, ebpf_module_t *em)
193
{
194
struct target *w;
195
collected_number value;
@@ -189,7 +197,7 @@ void ebpf_process_send_apps_data(struct target *root)
197
write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_TASK_PROCESS);
198
for (w = root; w; w = w->next) {
199
if (unlikely(w->exposed && w->processes)) {
192
- value = ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, call_do_fork));
200
+ value = ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, create_process));
201
write_chart_dimension(w->name, value);
202
}
203
}
@@ -198,7 +206,17 @@ void ebpf_process_send_apps_data(struct target *root)
206
write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_TASK_THREAD);
207
for (w = root; w; w = w->next) {
208
if (unlikely(w->exposed && w->processes)) {
201
- value = ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, call_sys_clone));
209
+ value = ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, create_thread));
210
+ write_chart_dimension(w->name, value);
211
+ }
212
+ }
213
+ write_end_chart();
214
+
215
+ write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_TASK_EXIT);
216
+ for (w = root; w; w = w->next) {
217
+ if (unlikely(w->exposed && w->processes)) {
218
+ value = ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t,
219
+ call_do_exit));
220
write_chart_dimension(w->name, value);
221
}
222
}
@@ -214,6 +232,18 @@ void ebpf_process_send_apps_data(struct target *root)
232
}
233
write_end_chart();
234
235
+ if (em->mode < MODE_ENTRY) {
236
+ write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_TASK_ERROR);
237
+ for (w = root; w; w = w->next) {
238
+ if (unlikely(w->exposed && w->processes)) {
239
+ value = ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t,
240
+ task_err));
241
+ write_chart_dimension(w->name, value);
242
+ }
243
+ }
244
+ write_end_chart();
245
+ }
246
+
247
ebpf_process_remove_pids();
248
}
249
@@ -279,11 +309,10 @@ static void ebpf_process_update_apps_data()
309
//Read data
310
cad->call_do_exit = ps->exit_call;
311
cad->call_release_task = ps->release_call;
282
- cad->call_do_fork = ps->fork_call;
283
- cad->call_sys_clone = ps->clone_call;
312
+ cad->create_process = ps->create_process;
313
+ cad->create_thread = ps->create_thread;
314
285
- cad->ecall_do_fork = ps->fork_err;
286
- cad->ecall_sys_clone = ps->clone_err;
315
+ cad->task_err = ps->task_err;
316
317
pids = pids->next;
318
}
@@ -358,7 +387,7 @@ static void ebpf_process_status_chart(char *family, char *name, char *axis,
387
*/
388
static void ebpf_create_global_charts(ebpf_module_t *em)
389
{
361
- ebpf_create_chart(NETDATA_EBPF_FAMILY,
390
+ ebpf_create_chart(NETDATA_EBPF_SYSTEM_GROUP,
391
NETDATA_PROCESS_SYSCALL,
392
"Start process",
393
EBPF_COMMON_DIMENSION_CALL,
@@ -370,7 +399,7 @@ static void ebpf_create_global_charts(ebpf_module_t *em)
399
&process_publish_aggregated[NETDATA_KEY_PUBLISH_PROCESS_FORK],
400
2, NETDATA_EBPF_MODULE_NAME_PROCESS);
401
373
- ebpf_create_chart(NETDATA_EBPF_FAMILY,
402
+ ebpf_create_chart(NETDATA_EBPF_SYSTEM_GROUP,
403
NETDATA_EXIT_SYSCALL,
404
"Exit process",
405
EBPF_COMMON_DIMENSION_CALL,
@@ -382,7 +411,7 @@ static void ebpf_create_global_charts(ebpf_module_t *em)
411
&process_publish_aggregated[NETDATA_KEY_PUBLISH_PROCESS_EXIT],
412
2, NETDATA_EBPF_MODULE_NAME_PROCESS);
413
385
- ebpf_process_status_chart(NETDATA_EBPF_FAMILY,
414
+ ebpf_process_status_chart(NETDATA_EBPF_SYSTEM_GROUP,
415
NETDATA_PROCESS_STATUS_NAME,
416
EBPF_COMMON_DIMENSION_DIFFERENCE,
417
NETDATA_PROCESS_GROUP,
@@ -390,7 +419,7 @@ static void ebpf_create_global_charts(ebpf_module_t *em)
419
21004);
420
421
if (em->mode < MODE_ENTRY) {
393
- ebpf_create_chart(NETDATA_EBPF_FAMILY,
422
+ ebpf_create_chart(NETDATA_EBPF_SYSTEM_GROUP,
423
NETDATA_PROCESS_ERROR_NAME,
424
"Fails to create process",
425
EBPF_COMMON_DIMENSION_CALL,
@@ -414,12 +443,11 @@ static void ebpf_create_global_charts(ebpf_module_t *em)
443
*/
444
void ebpf_process_create_apps_charts(struct ebpf_module *em, void *ptr)
445
{
417
- UNUSED(em);
446
struct target *root = ptr;
447
ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_TASK_PROCESS,
448
"Process started",
449
EBPF_COMMON_DIMENSION_CALL,
422
- NETDATA_APPS_PROCESS_GROUP,
450
+ NETDATA_PROCESS_GROUP,
451
NETDATA_EBPF_CHART_TYPE_STACKED,
452
20065,
453
ebpf_algorithms[NETDATA_EBPF_ABSOLUTE_IDX],
@@ -428,20 +456,41 @@ void ebpf_process_create_apps_charts(struct ebpf_module *em, void *ptr)
456
ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_TASK_THREAD,
457
"Threads started",
458
EBPF_COMMON_DIMENSION_CALL,
431
- NETDATA_APPS_PROCESS_GROUP,
459
+ NETDATA_PROCESS_GROUP,
460
NETDATA_EBPF_CHART_TYPE_STACKED,
461
20066,
462
ebpf_algorithms[NETDATA_EBPF_ABSOLUTE_IDX],
463
root, NETDATA_EBPF_MODULE_NAME_PROCESS);
464
465
+ ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_TASK_EXIT,
466
+ "Tasks starts exit process.",
467
+ EBPF_COMMON_DIMENSION_CALL,
468
+ NETDATA_PROCESS_GROUP,
469
+ NETDATA_EBPF_CHART_TYPE_STACKED,
470
+ 20067,
471
+ ebpf_algorithms[NETDATA_EBPF_ABSOLUTE_IDX],
472
+ root, NETDATA_EBPF_MODULE_NAME_PROCESS);
473
+
474
ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_TASK_CLOSE,
475
"Tasks closed",
476
EBPF_COMMON_DIMENSION_CALL,
440
- NETDATA_APPS_PROCESS_GROUP,
477
+ NETDATA_PROCESS_GROUP,
478
NETDATA_EBPF_CHART_TYPE_STACKED,
442
- 20067,
479
+ 20068,
480
ebpf_algorithms[NETDATA_EBPF_ABSOLUTE_IDX],
481
root, NETDATA_EBPF_MODULE_NAME_PROCESS);
482
+
483
+ if (em->mode < MODE_ENTRY) {
484
+ ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_TASK_ERROR,
485
+ "Errors to create process or threads.",
486
+ EBPF_COMMON_DIMENSION_CALL,
487
+ NETDATA_PROCESS_GROUP,
488
+ NETDATA_EBPF_CHART_TYPE_STACKED,
489
+ 20069,
490
+ ebpf_algorithms[NETDATA_EBPF_ABSOLUTE_IDX],
491
+ root,
492
+ NETDATA_EBPF_MODULE_NAME_PROCESS);
493
+ }
494
}
495
496
/**
@@ -547,22 +596,20 @@ static void ebpf_process_sum_cgroup_pids(ebpf_process_stat_t *ps, struct pid_on_
596
597
accumulator.exit_call += ps->exit_call;
598
accumulator.release_call += ps->release_call;
550
- accumulator.fork_call += ps->fork_call;
551
- accumulator.clone_call += ps->clone_call;
599
+ accumulator.create_process += ps->create_process;
600
+ accumulator.create_thread += ps->create_thread;
601
553
- accumulator.fork_err += ps->fork_err;
554
- accumulator.clone_err += ps->clone_err;
602
+ accumulator.task_err += ps->task_err;
603
604
pids = pids->next;
605
}
606
607
ps->exit_call = (accumulator.exit_call >= ps->exit_call) ? accumulator.exit_call : ps->exit_call;
608
ps->release_call = (accumulator.release_call >= ps->release_call) ? accumulator.release_call : ps->release_call;
561
- ps->fork_call = (accumulator.fork_call >= ps->fork_call) ? accumulator.fork_call : ps->fork_call;
562
- ps->clone_call = (accumulator.clone_call >= ps->clone_call) ? accumulator.clone_call : ps->clone_call;
609
+ ps->create_process = (accumulator.create_process >= ps->create_process) ? accumulator.create_process : ps->create_process;
610
+ ps->create_thread = (accumulator.create_thread >= ps->create_thread) ? accumulator.create_thread : ps->create_thread;
611
564
- ps->fork_err = (accumulator.fork_err >= ps->fork_err) ? accumulator.fork_err : ps->fork_err;
565
- ps->clone_err = (accumulator.clone_err >= ps->clone_err) ? accumulator.clone_err : ps->clone_err;
612
+ ps->task_err = (accumulator.task_err >= ps->task_err) ? accumulator.task_err : ps->task_err;
613
}
614
615
/*
@@ -572,23 +619,36 @@ static void ebpf_process_sum_cgroup_pids(ebpf_process_stat_t *ps, struct pid_on_
619
*
620
* @param type chart type
621
* @param values structure with values that will be sent to netdata
622
+ * @param em the structure with thread information
623
*/
576
-static void ebpf_send_specific_process_data(char *type, ebpf_process_stat_t *values)
624
+static void ebpf_send_specific_process_data(char *type, ebpf_process_stat_t *values, ebpf_module_t *em)
625
{
626
write_begin_chart(type, NETDATA_SYSCALL_APPS_TASK_PROCESS);
627
write_chart_dimension(process_publish_aggregated[NETDATA_KEY_PUBLISH_PROCESS_FORK].name,
580
- (long long) values->fork_call);
628
+ (long long) values->create_process);
629
write_end_chart();
630
631
write_begin_chart(type, NETDATA_SYSCALL_APPS_TASK_THREAD);
632
write_chart_dimension(process_publish_aggregated[NETDATA_KEY_PUBLISH_PROCESS_CLONE].name,
585
- (long long) values->clone_call);
633
+ (long long) values->create_thread);
634
write_end_chart();
635
588
- write_begin_chart(type, NETDATA_SYSCALL_APPS_TASK_CLOSE);
636
+ write_begin_chart(type, NETDATA_SYSCALL_APPS_TASK_EXIT);
637
write_chart_dimension(process_publish_aggregated[NETDATA_KEY_PUBLISH_PROCESS_EXIT].name,
638
(long long) values->release_call);
639
write_end_chart();
640
+
641
+ write_begin_chart(type, NETDATA_SYSCALL_APPS_TASK_CLOSE);
642
+ write_chart_dimension(process_publish_aggregated[NETDATA_KEY_PUBLISH_PROCESS_RELEASE_TASK].name,
643
+ (long long) values->release_call);
644
+ write_end_chart();
645
+
646
+ if (em->mode < MODE_ENTRY) {
647
+ write_begin_chart(type, NETDATA_SYSCALL_APPS_TASK_ERROR);
648
+ write_chart_dimension(process_publish_aggregated[NETDATA_KEY_PUBLISH_PROCESS_EXIT].name,
649
+ (long long) values->task_err);
650
+ write_end_chart();
651
+ }
652
}
653
654
/**
@@ -597,8 +657,9 @@ static void ebpf_send_specific_process_data(char *type, ebpf_process_stat_t *val
657
* Create charts for cgroup/application
658
*
659
* @param type the chart type.
660
+ * @param em the structure with thread information
661
*/
601
-static void ebpf_create_specific_process_charts(char *type)
662
+static void ebpf_create_specific_process_charts(char *type, ebpf_module_t *em)
663
{
664
ebpf_create_chart(type, NETDATA_SYSCALL_APPS_TASK_PROCESS, "Process started",
665
EBPF_COMMON_DIMENSION_CALL, NETDATA_PROCESS_CGROUP_GROUP,
@@ -615,13 +676,31 @@ static void ebpf_create_specific_process_charts(char *type)
676
&process_publish_aggregated[NETDATA_KEY_PUBLISH_PROCESS_CLONE],
677
1, NETDATA_EBPF_MODULE_NAME_PROCESS);
678
618
- ebpf_create_chart(type, NETDATA_SYSCALL_APPS_TASK_CLOSE, "Tasks closed",
679
+ ebpf_create_chart(type, NETDATA_SYSCALL_APPS_TASK_EXIT, "Tasks starts exit process.",
680
EBPF_COMMON_DIMENSION_CALL, NETDATA_PROCESS_CGROUP_GROUP,
620
- NETDATA_CGROUP_PROCESS_CLOSE_CONTEXT,
681
+ NETDATA_CGROUP_PROCESS_EXIT_CONTEXT,
682
NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5002,
683
ebpf_create_global_dimension,
684
&process_publish_aggregated[NETDATA_KEY_PUBLISH_PROCESS_EXIT],
685
1, NETDATA_EBPF_MODULE_NAME_PROCESS);
686
+
687
+ ebpf_create_chart(type, NETDATA_SYSCALL_APPS_TASK_CLOSE, "Tasks closed",
688
+ EBPF_COMMON_DIMENSION_CALL, NETDATA_PROCESS_CGROUP_GROUP,
689
+ NETDATA_CGROUP_PROCESS_CLOSE_CONTEXT,
690
+ NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5003,
691
+ ebpf_create_global_dimension,
692
+ &process_publish_aggregated[NETDATA_KEY_PUBLISH_PROCESS_RELEASE_TASK],
693
+ 1, NETDATA_EBPF_MODULE_NAME_PROCESS);
694
+
695
+ if (em->mode < MODE_ENTRY) {
696
+ ebpf_create_chart(type, NETDATA_SYSCALL_APPS_TASK_ERROR, "Errors to create process or threads.",
697
+ EBPF_COMMON_DIMENSION_CALL, NETDATA_PROCESS_CGROUP_GROUP,
698
+ NETDATA_CGROUP_PROCESS_ERROR_CONTEXT,
699
+ NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5004,
700
+ ebpf_create_global_dimension,
701
+ &process_publish_aggregated[NETDATA_KEY_PUBLISH_PROCESS_EXIT],
702
+ 1, NETDATA_EBPF_MODULE_NAME_PROCESS);
703
+ }
704
}
705
706
/**
@@ -630,8 +709,9 @@ static void ebpf_create_specific_process_charts(char *type)
709
* Obsolete charts for cgroup/application
710
*
711
* @param type the chart type.
712
+ * @param em the structure with thread information
713
*/
634
-static void ebpf_obsolete_specific_process_charts(char *type)
714
+static void ebpf_obsolete_specific_process_charts(char *type, ebpf_module_t *em)
715
{
716
ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_TASK_PROCESS, "Process started",
717
EBPF_COMMON_DIMENSION_CALL, NETDATA_PROCESS_GROUP, NETDATA_EBPF_CHART_TYPE_LINE,
@@ -641,17 +721,29 @@ static void ebpf_obsolete_specific_process_charts(char *type)
721
EBPF_COMMON_DIMENSION_CALL, NETDATA_PROCESS_GROUP, NETDATA_EBPF_CHART_TYPE_LINE,
722
NETDATA_CGROUP_THREAD_CREATE_CONTEXT, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5001);
723
724
+ ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_TASK_EXIT,"Tasks starts exit process.",
725
+ EBPF_COMMON_DIMENSION_CALL, NETDATA_PROCESS_GROUP, NETDATA_EBPF_CHART_TYPE_LINE,
726
+ NETDATA_CGROUP_PROCESS_EXIT_CONTEXT, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5003);
727
+
728
ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_TASK_CLOSE,"Tasks closed",
729
EBPF_COMMON_DIMENSION_CALL, NETDATA_PROCESS_GROUP, NETDATA_EBPF_CHART_TYPE_LINE,
646
- NETDATA_CGROUP_PROCESS_CLOSE_CONTEXT, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5002);
730
+ NETDATA_CGROUP_PROCESS_CLOSE_CONTEXT, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5003);
731
+
732
+ if (em->mode < MODE_ENTRY) {
733
+ ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_TASK_ERROR,"Errors to create process or threads.",
734
+ EBPF_COMMON_DIMENSION_CALL, NETDATA_PROCESS_GROUP, NETDATA_EBPF_CHART_TYPE_LINE,
735
+ NETDATA_CGROUP_PROCESS_ERROR_CONTEXT, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5004);
736
+ }
737
}
738
739
/**
740
* Create Systemd process Charts
741
*
742
* Create charts when systemd is enabled
743
+ *
744
+ * @param em the structure with thread information
745
**/
654
-static void ebpf_create_systemd_process_charts()
746
+static void ebpf_create_systemd_process_charts(ebpf_module_t *em)
747
{
748
ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_TASK_PROCESS, "Process started",
749
EBPF_COMMON_DIMENSION_CALL, NETDATA_APPS_PROCESS_GROUP,
@@ -665,11 +757,25 @@ static void ebpf_create_systemd_process_charts()
757
ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_THREAD_CREATE_CONTEXT,
758
NETDATA_EBPF_MODULE_NAME_PROCESS);
759
668
- ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_TASK_CLOSE, "Tasks closed",
760
+ ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_TASK_CLOSE, "Tasks starts exit process.",
761
EBPF_COMMON_DIMENSION_CALL, NETDATA_APPS_PROCESS_GROUP,
762
NETDATA_EBPF_CHART_TYPE_STACKED, 20067,
763
+ ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_PROCESS_EXIT_CONTEXT,
764
+ NETDATA_EBPF_MODULE_NAME_PROCESS);
765
+
766
+ ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_TASK_EXIT, "Tasks closed",
767
+ EBPF_COMMON_DIMENSION_CALL, NETDATA_APPS_PROCESS_GROUP,
768
+ NETDATA_EBPF_CHART_TYPE_STACKED, 20068,
769
ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_PROCESS_CLOSE_CONTEXT,
770
NETDATA_EBPF_MODULE_NAME_PROCESS);
771
+
772
+ if (em->mode < MODE_ENTRY) {
773
+ ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_TASK_ERROR, "Errors to create process or threads.",
774
+ EBPF_COMMON_DIMENSION_CALL, NETDATA_APPS_PROCESS_GROUP,
775
+ NETDATA_EBPF_CHART_TYPE_STACKED, 20069,
776
+ ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_PROCESS_ERROR_CONTEXT,
777
+ NETDATA_EBPF_MODULE_NAME_PROCESS);
778
+ }
779
}
780
781
/**
@@ -677,17 +783,19 @@ static void ebpf_create_systemd_process_charts()
783
*
784
* Send collected data to Netdata.
785
*
786
+ * @param em the structure with thread information
787
+ *
788
* @return It returns the status for chart creation, if it is necessary to remove a specific dimension, zero is returned
789
* otherwise function returns 1 to avoid chart recreation
790
*/
683
-static int ebpf_send_systemd_process_charts()
791
+static int ebpf_send_systemd_process_charts(ebpf_module_t *em)
792
{
793
int ret = 1;
794
ebpf_cgroup_target_t *ect;
795
write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_TASK_PROCESS);
796
for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
797
if (unlikely(ect->systemd) && unlikely(ect->updated)) {
690
- write_chart_dimension(ect->name, ect->publish_systemd_ps.fork_call);
798
+ write_chart_dimension(ect->name, ect->publish_systemd_ps.create_process);
799
} else
800
ret = 0;
801
}
@@ -696,7 +804,15 @@ static int ebpf_send_systemd_process_charts()
804
write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_TASK_THREAD);
805
for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
806
if (unlikely(ect->systemd) && unlikely(ect->updated)) {
699
- write_chart_dimension(ect->name, ect->publish_systemd_ps.clone_call);
807
+ write_chart_dimension(ect->name, ect->publish_systemd_ps.create_thread);
808
+ }
809
+ }
810
+ write_end_chart();
811
+
812
+ write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_TASK_EXIT);
813
+ for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
814
+ if (unlikely(ect->systemd) && unlikely(ect->updated)) {
815
+ write_chart_dimension(ect->name, ect->publish_systemd_ps.exit_call);
816
}
817
}
818
write_end_chart();
@@ -709,13 +825,25 @@ static int ebpf_send_systemd_process_charts()
825
}
826
write_end_chart();
827
828
+ if (em->mode < MODE_ENTRY) {
829
+ write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_TASK_ERROR);
830
+ for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
831
+ if (unlikely(ect->systemd) && unlikely(ect->updated)) {
832
+ write_chart_dimension(ect->name, ect->publish_systemd_ps.task_err);
833
+ }
834
+ }
835
+ write_end_chart();
836
+ }
837
+
838
return ret;
839
}
840
841
/**
842
* Send data to Netdata calling auxiliar functions.
843
+ *
844
+ * @param em the structure with thread information
845
*/
718
-static void ebpf_process_send_cgroup_data()
846
+static void ebpf_process_send_cgroup_data(ebpf_module_t *em)
847
{
848
if (!ebpf_cgroup_pids)
849
return;
@@ -731,11 +859,11 @@ static void ebpf_process_send_cgroup_data()
859
if (has_systemd) {
860
static int systemd_chart = 0;
861
if (!systemd_chart) {
734
- ebpf_create_systemd_process_charts();
862
+ ebpf_create_systemd_process_charts(em);
863
systemd_chart = 1;
864
}
865
738
- systemd_chart = ebpf_send_systemd_process_charts();
866
+ systemd_chart = ebpf_send_systemd_process_charts(em);
867
}
868
869
for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
@@ -743,15 +871,15 @@ static void ebpf_process_send_cgroup_data()
871
continue;
872
873
if (!(ect->flags & NETDATA_EBPF_CGROUP_HAS_PROCESS_CHART) && ect->updated) {
746
- ebpf_create_specific_process_charts(ect->name);
874
+ ebpf_create_specific_process_charts(ect->name, em);
875
ect->flags |= NETDATA_EBPF_CGROUP_HAS_PROCESS_CHART;
876
}
877
878
if (ect->flags & NETDATA_EBPF_CGROUP_HAS_PROCESS_CHART) {
879
if (ect->updated) {
752
- ebpf_send_specific_process_data(ect->name, &ect->publish_systemd_ps);
880
+ ebpf_send_specific_process_data(ect->name, &ect->publish_systemd_ps, em);
881
} else {
754
- ebpf_obsolete_specific_process_charts(ect->name);
882
+ ebpf_obsolete_specific_process_charts(ect->name, em);
883
ect->flags &= ~NETDATA_EBPF_CGROUP_HAS_PROCESS_CHART;
884
}
885
}
@@ -831,11 +959,11 @@ static void process_collector(usec_t step, ebpf_module_t *em)
959
}
960
961
if (publish_apps) {
834
- ebpf_process_send_apps_data(apps_groups_root_target);
962
+ ebpf_process_send_apps_data(apps_groups_root_target, em);
963
}
964
965
if (cgroups) {
838
- ebpf_process_send_cgroup_data();
966
+ ebpf_process_send_cgroup_data(em);
967
}
968
pthread_mutex_unlock(&lock);
969
@@ -863,6 +991,30 @@ void clean_global_memory() {
991
}
992
}
993
994
+/**
995
+ * Process disable tracepoints
996
+ *
997
+ * Disable tracepoints when the plugin was responsible to enable it.
998
+ */
999
+static void ebpf_process_disable_tracepoints()
1000
+{
1001
+ char *default_message = { "Cannot disable the tracepoint" };
1002
+ if (!was_sched_process_exit_enabled) {
1003
+ if (ebpf_disable_tracing_values(tracepoint_sched_type, tracepoint_sched_process_exit))
1004
+ error("%s %s/%s.", default_message, tracepoint_sched_type, tracepoint_sched_process_exit);
1005
+ }
1006
+
1007
+ if (!was_sched_process_exec_enabled) {
1008
+ if (ebpf_disable_tracing_values(tracepoint_sched_type, tracepoint_sched_process_exec))
1009
+ error("%s %s/%s.", default_message, tracepoint_sched_type, tracepoint_sched_process_exec);
1010
+ }
1011
+
1012
+ if (!was_sched_process_fork_enabled) {
1013
+ if (ebpf_disable_tracing_values(tracepoint_sched_type, tracepoint_sched_process_fork))
1014
+ error("%s %s/%s.", default_message, tracepoint_sched_type, tracepoint_sched_process_fork);
1015
+ }
1016
+}
1017
+
1018
/**
1019
* Clean up the main thread.
1020
*
@@ -887,6 +1039,8 @@ static void ebpf_process_cleanup(void *ptr)
1039
freez(global_process_stats);
1040
freez(current_apps_data);
1041
1042
+ ebpf_process_disable_tracepoints();
1043
+
1044
if (probe_links) {
1045
struct bpf_program *prog;
1046
size_t i = 0 ;
@@ -973,6 +1127,45 @@ static void wait_for_all_threads_die()
1127
}
1128
}
1129
1130
+/**
1131
+ * Enable tracepoints
1132
+ *
1133
+ * Enable necessary tracepoints for thread.
1134
+ *
1135
+ * @return It returns 0 on success and -1 otherwise
1136
+ */
1137
+static int ebpf_process_enable_tracepoints()
1138
+{
1139
+ int test = ebpf_is_tracepoint_enabled(tracepoint_sched_type, tracepoint_sched_process_exit);
1140
+ if (test == -1)
1141
+ return -1;
1142
+ else if (!test) {
1143
+ if (ebpf_enable_tracing_values(tracepoint_sched_type, tracepoint_sched_process_exit))
1144
+ return -1;
1145
+ }
1146
+ was_sched_process_exit_enabled = test;
1147
+
1148
+ test = ebpf_is_tracepoint_enabled(tracepoint_sched_type, tracepoint_sched_process_exec);
1149
+ if (test == -1)
1150
+ return -1;
1151
+ else if (!test) {
1152
+ if (ebpf_enable_tracing_values(tracepoint_sched_type, tracepoint_sched_process_exec))
1153
+ return -1;
1154
+ }
1155
+ was_sched_process_exec_enabled = test;
1156
+
1157
+ test = ebpf_is_tracepoint_enabled(tracepoint_sched_type, tracepoint_sched_process_fork);
1158
+ if (test == -1)
1159
+ return -1;
1160
+ else if (!test) {
1161
+ if (ebpf_enable_tracing_values(tracepoint_sched_type, tracepoint_sched_process_fork))
1162
+ return -1;
1163
+ }
1164
+ was_sched_process_fork_enabled = test;
1165
+
1166
+ return 0;
1167
+}
1168
+
1169
/**
1170
* Process thread
1171
*
@@ -988,6 +1181,10 @@ void *ebpf_process_thread(void *ptr)
1181
1182
ebpf_module_t *em = (ebpf_module_t *)ptr;
1183
em->maps = process_maps;
1184
+
1185
+ if (ebpf_process_enable_tracepoints()) {
1186
+ em->enabled = em->global_charts = em->apps_charts = em->cgroup_charts = CONFIG_BOOLEAN_NO;
1187
+ }
1188
process_enabled = em->enabled;
1189
1190
pthread_mutex_lock(&lock);
collectors/ebpf.plugin/ebpf_process.h
+11
-6
@@ -7,8 +7,8 @@
7
#define NETDATA_EBPF_MODULE_NAME_PROCESS "process"
8
9
// Groups used on Dashboard
10
-#define NETDATA_PROCESS_GROUP "process"
11
-#define NETDATA_PROCESS_CGROUP_GROUP "process (eBPF)"
10
+#define NETDATA_PROCESS_GROUP "processes"
11
+#define NETDATA_PROCESS_CGROUP_GROUP "processes (eBPF)"
12
13
// Global chart name
14
#define NETDATA_EXIT_SYSCALL "exit"
@@ -19,7 +19,9 @@
19
// Charts created on Apps submenu
20
#define NETDATA_SYSCALL_APPS_TASK_PROCESS "process_create"
21
#define NETDATA_SYSCALL_APPS_TASK_THREAD "thread_create"
22
+#define NETDATA_SYSCALL_APPS_TASK_EXIT "task_exit"
23
#define NETDATA_SYSCALL_APPS_TASK_CLOSE "task_close"
24
+#define NETDATA_SYSCALL_APPS_TASK_ERROR "task_error"
25
26
// Process configuration name
27
#define NETDATA_PROCESS_CONFIG_FILE "process.conf"
@@ -28,10 +30,14 @@
30
#define NETDATA_CGROUP_PROCESS_CREATE_CONTEXT "cgroup.process_create"
31
#define NETDATA_CGROUP_THREAD_CREATE_CONTEXT "cgroup.thread_create"
32
#define NETDATA_CGROUP_PROCESS_CLOSE_CONTEXT "cgroup.task_close"
33
+#define NETDATA_CGROUP_PROCESS_EXIT_CONTEXT "cgroup.task_exit"
34
+#define NETDATA_CGROUP_PROCESS_ERROR_CONTEXT "cgroup.task_error"
35
36
#define NETDATA_SYSTEMD_PROCESS_CREATE_CONTEXT "services.process_create"
37
#define NETDATA_SYSTEMD_THREAD_CREATE_CONTEXT "services.thread_create"
38
#define NETDATA_SYSTEMD_PROCESS_CLOSE_CONTEXT "services.task_close"
39
+#define NETDATA_SYSTEMD_PROCESS_EXIT_CONTEXT "services.task_exit"
40
+#define NETDATA_SYSTEMD_PROCESS_ERROR_CONTEXT "services.task_error"
41
42
// Index from kernel
43
typedef enum ebpf_process_index {
@@ -66,12 +72,11 @@ typedef struct ebpf_process_publish_apps {
72
// Number of calls during the last read
73
uint64_t call_do_exit;
74
uint64_t call_release_task;
69
- uint64_t call_do_fork;
70
- uint64_t call_sys_clone;
75
+ uint64_t create_process;
76
+ uint64_t create_thread;
77
78
// Number of errors during the last read
73
- uint64_t ecall_do_fork;
74
- uint64_t ecall_sys_clone;
79
+ uint64_t task_err;
80
} ebpf_process_publish_apps_t;
81
82
enum ebpf_process_tables {
packaging/ebpf.checksums
+3
-3
@@ -1,3 +1,3 @@
1
-f8e89d3a37b49f2b14d66dace463545e19bbcb5f486f0ef525d8e57b4acf809b netdata-kernel-collector-glibc-v0.8.1.tar.xz
2
-094d4a9b05463031feb432cdaf599570e77df226ea743ee16b11178de00ca930 netdata-kernel-collector-musl-v0.8.1.tar.xz
3
-2994127a98ac86f0028c8242ba41a0ccc69786c076cc236d27b187ea2d38876a netdata-kernel-collector-static-v0.8.1.tar.xz
1
+0e37657f98a8a287bd9798284ab4d6ed45fecd8b45e1e92e0c3bf04ba1e8c1fd netdata-kernel-collector-glibc-v0.8.2.tar.xz
2
+fbaea92c63293a220083febc2223e605cb43b6698469b13b44628194973babae netdata-kernel-collector-musl-v0.8.2.tar.xz
3
+8a7ff8a5d0d62c082be606dd4296e0b28563682ae2fbc89faaf730117e2ef016 netdata-kernel-collector-static-v0.8.2.tar.xz
packaging/ebpf.version
+1
-1
@@ -1 +1 @@
1
-v0.8.1
1
+v0.8.2
web/gui/dashboard_info.js
+50
-25
@@ -1310,6 +1310,26 @@ netdataDashboard.context = {
1310
info: 'The amount of time the system has been running, including time spent in suspend.'
1311
},
1312
1313
+ 'system.process_thread': {
1314
+ title : 'Task creation',
1315
+ info: 'Number of times that either <a href="https://www.ece.uic.edu/~yshi1/linux/lkse/node4.html#SECTION00421000000000000000" target="_blank">do_fork</a>, or <code>kernel_clone</code> if you are running kernel newer than 5.9.16, is called to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the threads monitoring tracepoint <code>sched_process_fork</code>. This chart is provided by eBPF plugin.'
1316
+ },
1317
+
1318
+ 'system.exit': {
1319
+ title : 'Exit monitoring',
1320
+ info: 'Calls for the functions responsible for closing (<a href="https://www.informit.com/articles/article.aspx?p=370047&seqNum=4" target="_blank">do_exit</a>) and releasing (<a href="https://www.informit.com/articles/article.aspx?p=370047&seqNum=4" target="_blank">release_task</a>) tasks. This chart is provided by eBPF plugin.'
1321
+ },
1322
+
1323
+ 'system.task_error': {
1324
+ title : 'Task error',
1325
+ info: 'Number of errors to create a new process or thread. This chart is provided by eBPF plugin.'
1326
+ },
1327
+
1328
+ 'system.process_status': {
1329
+ title : 'Task status',
1330
+ info: 'Difference between the number of process created and the number of threads created per period(<code>process</code> dimension), it also shows the number of possible zombie process running on system. This chart is provided by eBPF plugin.'
1331
+ },
1332
+
1333
// ------------------------------------------------------------------------
1334
// CPU charts
1335
@@ -2543,15 +2563,23 @@ netdataDashboard.context = {
2563
},
2564
2565
'apps.process_create': {
2546
- info: 'Calls to either <a href="https://programming.vip/docs/the-execution-procedure-of-do_fork-function-in-linux.html" target="_blank">do_fork</a>, or <code>kernel_clone</code> if you are running kernel newer than 5.9.16, to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the process by counting the number of calls to <a href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that do not have the flag <code>CLONE_THREAD</code> set.'
2566
+ info: 'Calls to either <a href="https://programming.vip/docs/the-execution-procedure-of-do_fork-function-in-linux.html" target="_blank">do_fork</a>, or <code>kernel_clone</code> if you are running kernel newer than 5.9.16, to create a new task, which is the common name used to define process and tasks inside the kernel. This chart is provided by eBPF plugin.'
2567
},
2568
2569
'apps.thread_create': {
2550
- info: 'Calls to either <a href="https://programming.vip/docs/the-execution-procedure-of-do_fork-function-in-linux.html" target="_blank">do_fork</a>, or <code>kernel_clone</code> if you are running kernel newer than 5.9.16, to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the threads by counting the number of calls to <a href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that have the flag <code>CLONE_THREAD</code> set.'
2570
+ info: 'Calls to either <a href="https://programming.vip/docs/the-execution-procedure-of-do_fork-function-in-linux.html" target="_blank">do_fork</a>, or <code>kernel_clone</code> if you are running kernel newer than 5.9.16, to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the threads monitoring tracepoint <code>sched_process_fork</code>. This chart is provided by eBPF plugin.'
2571
+ },
2572
+
2573
+ 'apps.task_exit': {
2574
+ info: 'Calls to the function responsible for closing (<a href="https://www.informit.com/articles/article.aspx?p=370047&seqNum=4" target="_blank">do_exit</a>) tasks. This chart is provided by eBPF plugin.'
2575
},
2576
2577
'apps.task_close': {
2554
- info: 'Calls to the functions responsible for closing (<a href="https://www.informit.com/articles/article.aspx?p=370047&seqNum=4" target="_blank">do_exit</a>) and releasing (<a href="https://www.informit.com/articles/article.aspx?p=370047&seqNum=4" target="_blank">release_task</a>) tasks.'
2578
+ info: 'Calls to the function responsible for releasing (<a href="https://www.informit.com/articles/article.aspx?p=370047&seqNum=4" target="_blank">release_task</a>) tasks. This chart is provided by eBPF plugin.'
2579
+ },
2580
+
2581
+ 'apps.task_error': {
2582
+ info: 'Number of errors to create a new process or thread. This chart is provided by eBPF plugin.'
2583
},
2584
2585
'apps.total_bandwidth_sent': {
@@ -3890,10 +3918,19 @@ netdataDashboard.context = {
3918
info: 'Calls to either <a href="https://programming.vip/docs/the-execution-procedure-of-do_fork-function-in-linux.html" target="_blank">do_fork</a>, or <code>kernel_clone</code> if you are running kernel newer than 5.9.16, to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the threads by counting the number of calls to <a href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that have the flag <code>CLONE_THREAD</code> set.'
3919
},
3920
3921
+ 'cgroup.task_exit': {
3922
+ info: 'Calls to the function responsible for closing (<a href="https://www.informit.com/articles/article.aspx?p=370047&seqNum=4" target="_blank">do_exit</a>) tasks.'
3923
+ },
3924
+
3925
'cgroup.task_close': {
3894
- info: 'Calls to the functions responsible for closing (<a href="https://www.informit.com/articles/article.aspx?p=370047&seqNum=4" target="_blank">do_exit</a>) and releasing (<a href="https://www.informit.com/articles/article.aspx?p=370047&seqNum=4" target="_blank">release_task</a>) tasks.'
3926
+ info: 'Calls to the functions responsible for releasing (<a href="https://www.informit.com/articles/article.aspx?p=370047&seqNum=4" target="_blank">release_task</a>) tasks.'
3927
},
3928
3929
+ 'cgroup.task_error': {
3930
+ info: 'Number of errors to create a new process or thread. This chart is provided by eBPF plugin.'
3931
+ },
3932
+
3933
+
3934
'cgroup.dc_ratio': {
3935
info: 'Percentage of file accesses that were present in the directory cache. 100% means that every file that was accessed was present in the directory cache. If files are not present in the directory cache 1) they are not present in the file system, 2) the files were not accessed before. Read more about <a href="https://www.kernel.org/doc/htmldocs/filesystems/the_directory_cache.html" target="_blank">directory cache</a>. Netdata also gives a summary for these charts in <a href="#menu_filesystem_submenu_directory_cache__eBPF_">Filesystem submenu</a>.'
3936
},
@@ -4151,8 +4188,16 @@ netdataDashboard.context = {
4188
info: 'Calls to either <a href="https://programming.vip/docs/the-execution-procedure-of-do_fork-function-in-linux.html" target="_blank">do_fork</a>, or <code>kernel_clone</code> if you are running kernel newer than 5.9.16, to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the threads by counting the number of calls to <a href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that have the flag <code>CLONE_THREAD</code> set.'
4189
},
4190
4191
+ 'services.task_exit': {
4192
+ info: 'Calls to the functions responsible for closing (<a href="https://www.informit.com/articles/article.aspx?p=370047&seqNum=4" target="_blank">do_exit</a>) tasks.'
4193
+ },
4194
+
4195
'services.task_close': {
4155
- info: 'Calls to the functions responsible for closing (<a href="https://www.informit.com/articles/article.aspx?p=370047&seqNum=4" target="_blank">do_exit</a>) and releasing (<a href="https://www.informit.com/articles/article.aspx?p=370047&seqNum=4" target="_blank">release_task</a>) tasks.'
4196
+ info: 'Calls to the functions responsible for releasing (<a href="https://www.informit.com/articles/article.aspx?p=370047&seqNum=4" target="_blank">release_task</a>) tasks.'
4197
+ },
4198
+
4199
+ 'services.task_error': {
4200
+ info: 'Number of errors to create a new process or thread. This chart is provided by eBPF plugin.'
4201
},
4202
4203
'services.dc_ratio': {
@@ -5795,26 +5840,6 @@ netdataDashboard.context = {
5840
// ------------------------------------------------------------------------
5841
// eBPF
5842
5798
- 'ebpf.process_thread': {
5799
- title : 'Task creation',
5800
- info: 'Number of times that either <a href="https://www.ece.uic.edu/~yshi1/linux/lkse/node4.html#SECTION00421000000000000000" target="_blank">do_fork</a>, or <code>kernel_clone</code> if you are running kernel newer than 5.9.16, is called to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the threads by counting the number of calls for <a href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that has the flag <code>CLONE_THREAD</code> set.'
5801
- },
5802
-
5803
- 'ebpf.exit': {
5804
- title : 'Exit monitoring',
5805
- info: 'Calls for the functions responsible for closing (<a href="https://www.informit.com/articles/article.aspx?p=370047&seqNum=4" target="_blank">do_exit</a>) and releasing (<a href="https://www.informit.com/articles/article.aspx?p=370047&seqNum=4" target="_blank">release_task</a>) tasks.'
5806
- },
5807
-
5808
- 'ebpf.task_error': {
5809
- title : 'Task error',
5810
- info: 'Number of errors to create a new process or thread.'
5811
- },
5812
-
5813
- 'ebpf.process_status': {
5814
- title : 'Task status',
5815
- info: 'Difference between the number of process created and the number of threads created per period(<code>process</code> dimension), it also shows the number of possible zombie process running on system.'
5816
- },
5817
-
5843
'apps.swap_read_call': {
5844
info: 'The function <code>swap_readpage</code> is called when the kernel reads a page from swap memory. Netdata also gives a summary for these charts in <a href="#menu_system_submenu_swap">System overview</a>.'
5845
},