@cryptotaxi247 / netdata-1 / commits / 8dd044b39

`tcp_v6_connect` monitoring (#16316)

thiagoftsm committed Nov 1, 2023 at 11:06 UTC 8dd044b39d63cfeb6f0ad1829f9ccb604174ba7b
3 files changed +135 -77
collectors/ebpf.plugin/ebpf_socket.c
+132 -77
@@ -75,6 +75,7 @@ static netdata_publish_syscall_t socket_publish_aggregated[NETDATA_MAX_SOCKET_VE
75 netdata_socket_t *socket_values;
76
77 ebpf_network_viewer_port_list_t *listen_ports = NULL;
78 +ebpf_addresses_t tcp_v6_connect_address = {.function = "tcp_v6_connect", .hash = 0, .addr = 0, .type = 0};
79
80 struct config socket_config = { .first_section = NULL,
81 .last_section = NULL,
@@ -177,11 +178,13 @@ static void ebpf_set_trampoline_target(struct socket_bpf *obj)
178 bpf_program__set_attach_target(obj->progs.netdata_tcp_v4_connect_fexit, 0,
179 socket_targets[NETDATA_FCNT_TCP_V4_CONNECT].name);
180
180 - bpf_program__set_attach_target(obj->progs.netdata_tcp_v6_connect_fentry, 0,
181 - socket_targets[NETDATA_FCNT_TCP_V6_CONNECT].name);
181 + if (tcp_v6_connect_address.type == 'T') {
182 + bpf_program__set_attach_target(
183 + obj->progs.netdata_tcp_v6_connect_fentry, 0, socket_targets[NETDATA_FCNT_TCP_V6_CONNECT].name);
184
183 - bpf_program__set_attach_target(obj->progs.netdata_tcp_v6_connect_fexit, 0,
185 + bpf_program__set_attach_target(obj->progs.netdata_tcp_v6_connect_fexit, 0,
186 socket_targets[NETDATA_FCNT_TCP_V6_CONNECT].name);
187 + }
188
189 bpf_program__set_attach_target(obj->progs.netdata_tcp_retransmit_skb_fentry, 0,
190 socket_targets[NETDATA_FCNT_TCP_RETRANSMIT].name);
@@ -332,12 +335,13 @@ static long ebpf_socket_attach_probes(struct socket_bpf *obj, netdata_run_mode_t
335 if (ret)
336 return -1;
337
335 - obj->links.netdata_tcp_v6_connect_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_tcp_v6_connect_kretprobe,
336 - true,
337 - socket_targets[NETDATA_FCNT_TCP_V6_CONNECT].name);
338 - ret = libbpf_get_error(obj->links.netdata_tcp_v6_connect_kretprobe);
339 - if (ret)
340 - return -1;
338 + if (tcp_v6_connect_address.type == 'T') {
339 + obj->links.netdata_tcp_v6_connect_kretprobe = bpf_program__attach_kprobe(
340 + obj->progs.netdata_tcp_v6_connect_kretprobe, true, socket_targets[NETDATA_FCNT_TCP_V6_CONNECT].name);
341 + ret = libbpf_get_error(obj->links.netdata_tcp_v6_connect_kretprobe);
342 + if (ret)
343 + return -1;
344 + }
345 } else {
346 obj->links.netdata_tcp_sendmsg_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_tcp_sendmsg_kprobe,
347 false,
@@ -360,12 +364,14 @@ static long ebpf_socket_attach_probes(struct socket_bpf *obj, netdata_run_mode_t
364 if (ret)
365 return -1;
366
363 - obj->links.netdata_tcp_v6_connect_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_tcp_v6_connect_kprobe,
364 - false,
365 - socket_targets[NETDATA_FCNT_TCP_V6_CONNECT].name);
366 - ret = libbpf_get_error(obj->links.netdata_tcp_v6_connect_kprobe);
367 - if (ret)
368 - return -1;
367 + if (tcp_v6_connect_address.type == 'T') {
368 + obj->links.netdata_tcp_v6_connect_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_tcp_v6_connect_kprobe,
369 + false,
370 + socket_targets[NETDATA_FCNT_TCP_V6_CONNECT].name);
371 + ret = libbpf_get_error(obj->links.netdata_tcp_v6_connect_kprobe);
372 + if (ret)
373 + return -1;
374 + }
375 }
376
377 return 0;
@@ -410,6 +416,17 @@ static void ebpf_socket_adjust_map(struct socket_bpf *obj, ebpf_module_t *em)
416 ebpf_update_map_type(obj->maps.tbl_lports, &socket_maps[NETDATA_SOCKET_LPORTS]);
417 }
418
419 +/**
420 + * Disable TCP V6 connect
421 + */
422 +static void ebpf_disable_tcp_v6_connect(struct socket_bpf *obj)
423 +{
424 + bpf_program__set_autoload(obj->progs.netdata_tcp_v6_connect_kretprobe, false);
425 + bpf_program__set_autoload(obj->progs.netdata_tcp_v6_connect_kprobe, false);
426 + bpf_program__set_autoload(obj->progs.netdata_tcp_v6_connect_fexit, false);
427 + bpf_program__set_autoload(obj->progs.netdata_tcp_v6_connect_fentry, false);
428 +}
429 +
430 /**
431 * Load and attach
432 *
@@ -438,6 +455,10 @@ static inline int ebpf_socket_load_and_attach(struct socket_bpf *obj, ebpf_modul
455
456 ebpf_socket_adjust_map(obj, em);
457
458 + if (tcp_v6_connect_address.type != 'T') {
459 + ebpf_disable_tcp_v6_connect(obj);
460 + }
461 +
462 int ret = socket_bpf__load(obj);
463 if (ret) {
464 fprintf(stderr, "failed to load BPF object: %d\n", ret);
@@ -502,15 +523,17 @@ static void ebpf_obsolete_systemd_socket_charts(int update_every)
523 order++,
524 update_every);
525
505 - ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
506 - NETDATA_NET_APPS_CONNECTION_TCP_V6,
507 - "Calls to tcp_v6_connection",
508 - EBPF_COMMON_DIMENSION_CONNECTIONS,
509 - NETDATA_APPS_NET_GROUP,
510 - NETDATA_EBPF_CHART_TYPE_STACKED,
511 - NETDATA_SERVICES_SOCKET_TCP_V6_CONN_CONTEXT,
512 - order++,
513 - update_every);
526 + if (tcp_v6_connect_address.type == 'T') {
527 + ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
528 + NETDATA_NET_APPS_CONNECTION_TCP_V6,
529 + "Calls to tcp_v6_connection",
530 + EBPF_COMMON_DIMENSION_CONNECTIONS,
531 + NETDATA_APPS_NET_GROUP,
532 + NETDATA_EBPF_CHART_TYPE_STACKED,
533 + NETDATA_SERVICES_SOCKET_TCP_V6_CONN_CONTEXT,
534 + order++,
535 + update_every);
536 + }
537
538 ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
539 NETDATA_NET_APPS_BANDWIDTH_RECV,
@@ -626,15 +649,17 @@ void ebpf_socket_obsolete_apps_charts(struct ebpf_module *em)
649 order++,
650 em->update_every);
651
629 - ebpf_write_chart_obsolete(NETDATA_APPS_FAMILY,
630 - NETDATA_NET_APPS_CONNECTION_TCP_V6,
631 - "Calls to tcp_v6_connection",
632 - EBPF_COMMON_DIMENSION_CONNECTIONS,
633 - NETDATA_APPS_NET_GROUP,
634 - NETDATA_EBPF_CHART_TYPE_STACKED,
635 - NULL,
636 - order++,
637 - em->update_every);
652 + if (tcp_v6_connect_address.type == 'T') {
653 + ebpf_write_chart_obsolete(NETDATA_APPS_FAMILY,
654 + NETDATA_NET_APPS_CONNECTION_TCP_V6,
655 + "Calls to tcp_v6_connection",
656 + EBPF_COMMON_DIMENSION_CONNECTIONS,
657 + NETDATA_APPS_NET_GROUP,
658 + NETDATA_EBPF_CHART_TYPE_STACKED,
659 + NULL,
660 + order++,
661 + em->update_every);
662 + }
663
664 ebpf_write_chart_obsolete(NETDATA_APPS_FAMILY,
665 NETDATA_NET_APPS_BANDWIDTH_SENT,
@@ -1016,15 +1041,17 @@ void ebpf_socket_send_apps_data(ebpf_module_t *em, struct ebpf_target *root)
1041 }
1042 write_end_chart();
1043
1019 - write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_NET_APPS_CONNECTION_TCP_V6);
1020 - for (w = root; w; w = w->next) {
1021 - if (unlikely(w->exposed && w->processes)) {
1022 - value = ebpf_socket_sum_values_for_pids(w->root_pid, offsetof(ebpf_socket_publish_apps_t,
1023 - call_tcp_v6_connection));
1024 - write_chart_dimension(w->name, value);
1044 + if (tcp_v6_connect_address.type == 'T') {
1045 + write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_NET_APPS_CONNECTION_TCP_V6);
1046 + for (w = root; w; w = w->next) {
1047 + if (unlikely(w->exposed && w->processes)) {
1048 + value = ebpf_socket_sum_values_for_pids(
1049 + w->root_pid, offsetof(ebpf_socket_publish_apps_t, call_tcp_v6_connection));
1050 + write_chart_dimension(w->name, value);
1051 + }
1052 }
1053 + write_end_chart();
1054 }
1027 - write_end_chart();
1055
1056 write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_NET_APPS_BANDWIDTH_SENT);
1057 for (w = root; w; w = w->next) {
@@ -1248,13 +1275,18 @@ void ebpf_socket_create_apps_charts(struct ebpf_module *em, void *ptr)
1275 ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
1276 root, em->update_every, NETDATA_EBPF_MODULE_NAME_SOCKET);
1277
1251 - ebpf_create_charts_on_apps(NETDATA_NET_APPS_CONNECTION_TCP_V6,
1252 - "Calls to tcp_v6_connection", EBPF_COMMON_DIMENSION_CONNECTIONS,
1253 - NETDATA_APPS_NET_GROUP,
1254 - NETDATA_EBPF_CHART_TYPE_STACKED,
1255 - order++,
1256 - ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
1257 - root, em->update_every, NETDATA_EBPF_MODULE_NAME_SOCKET);
1278 + if (tcp_v6_connect_address.type == 'T') {
1279 + ebpf_create_charts_on_apps(NETDATA_NET_APPS_CONNECTION_TCP_V6,
1280 + "Calls to tcp_v6_connection",
1281 + EBPF_COMMON_DIMENSION_CONNECTIONS,
1282 + NETDATA_APPS_NET_GROUP,
1283 + NETDATA_EBPF_CHART_TYPE_STACKED,
1284 + order++,
1285 + ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
1286 + root,
1287 + em->update_every,
1288 + NETDATA_EBPF_MODULE_NAME_SOCKET);
1289 + }
1290
1291 ebpf_create_charts_on_apps(NETDATA_NET_APPS_BANDWIDTH_SENT,
1292 "Bytes sent", EBPF_COMMON_DIMENSION_BITS,
@@ -2032,15 +2064,21 @@ static void ebpf_create_specific_socket_charts(char *type, int update_every)
2064 &socket_publish_aggregated[NETDATA_IDX_TCP_CONNECTION_V4], 1,
2065 update_every, NETDATA_EBPF_MODULE_NAME_SOCKET);
2066
2035 - ebpf_create_chart(type, NETDATA_NET_APPS_CONNECTION_TCP_V6,
2036 - "Calls to tcp_v6_connection",
2037 - EBPF_COMMON_DIMENSION_CONNECTIONS, NETDATA_CGROUP_NET_GROUP,
2038 - NETDATA_CGROUP_TCP_V6_CONN_CONTEXT,
2039 - NETDATA_EBPF_CHART_TYPE_LINE,
2040 - NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + order_basis++,
2041 - ebpf_create_global_dimension,
2042 - &socket_publish_aggregated[NETDATA_IDX_TCP_CONNECTION_V6], 1,
2043 - update_every, NETDATA_EBPF_MODULE_NAME_SOCKET);
2067 + if (tcp_v6_connect_address.type == 'T') {
2068 + ebpf_create_chart(type,
2069 + NETDATA_NET_APPS_CONNECTION_TCP_V6,
2070 + "Calls to tcp_v6_connection",
2071 + EBPF_COMMON_DIMENSION_CONNECTIONS,
2072 + NETDATA_CGROUP_NET_GROUP,
2073 + NETDATA_CGROUP_TCP_V6_CONN_CONTEXT,
2074 + NETDATA_EBPF_CHART_TYPE_LINE,
2075 + NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + order_basis++,
2076 + ebpf_create_global_dimension,
2077 + &socket_publish_aggregated[NETDATA_IDX_TCP_CONNECTION_V6],
2078 + 1,
2079 + update_every,
2080 + NETDATA_EBPF_MODULE_NAME_SOCKET);
2081 + }
2082
2083 ebpf_create_chart(type, NETDATA_NET_APPS_BANDWIDTH_RECV,
2084 "Bytes received",
@@ -2129,10 +2167,17 @@ static void ebpf_obsolete_specific_socket_charts(char *type, int update_every)
2167 NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_SERVICES_SOCKET_TCP_V4_CONN_CONTEXT,
2168 NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + order_basis++, update_every);
2169
2132 - ebpf_write_chart_obsolete(type, NETDATA_NET_APPS_CONNECTION_TCP_V6,"Calls to tcp_v6_connection",
2133 - EBPF_COMMON_DIMENSION_CONNECTIONS, NETDATA_APPS_NET_GROUP,
2134 - NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_SERVICES_SOCKET_TCP_V6_CONN_CONTEXT,
2135 - NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + order_basis++, update_every);
2170 + if (tcp_v6_connect_address.type == 'T') {
2171 + ebpf_write_chart_obsolete(type,
2172 + NETDATA_NET_APPS_CONNECTION_TCP_V6,
2173 + "Calls to tcp_v6_connection",
2174 + EBPF_COMMON_DIMENSION_CONNECTIONS,
2175 + NETDATA_APPS_NET_GROUP,
2176 + NETDATA_EBPF_CHART_TYPE_LINE,
2177 + NETDATA_SERVICES_SOCKET_TCP_V6_CONN_CONTEXT,
2178 + NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + order_basis++,
2179 + update_every);
2180 + }
2181
2182 ebpf_write_chart_obsolete(type, NETDATA_NET_APPS_BANDWIDTH_RECV, "Bytes received",
2183 EBPF_COMMON_DIMENSION_CALL, NETDATA_APPS_NET_GROUP,
@@ -2185,10 +2230,12 @@ static void ebpf_send_specific_socket_data(char *type, ebpf_socket_publish_apps_
2230 (long long) values->call_tcp_v4_connection);
2231 write_end_chart();
2232
2188 - write_begin_chart(type, NETDATA_NET_APPS_CONNECTION_TCP_V6);
2189 - write_chart_dimension(socket_publish_aggregated[NETDATA_IDX_TCP_CONNECTION_V6].name,
2190 - (long long) values->call_tcp_v6_connection);
2191 - write_end_chart();
2233 + if (tcp_v6_connect_address.type == 'T') {
2234 + write_begin_chart(type, NETDATA_NET_APPS_CONNECTION_TCP_V6);
2235 + write_chart_dimension(
2236 + socket_publish_aggregated[NETDATA_IDX_TCP_CONNECTION_V6].name, (long long)values->call_tcp_v6_connection);
2237 + write_end_chart();
2238 + }
2239
2240 write_begin_chart(type, NETDATA_NET_APPS_BANDWIDTH_SENT);
2241 write_chart_dimension(socket_publish_aggregated[NETDATA_IDX_TCP_SENDMSG].name,
@@ -2245,14 +2292,18 @@ static void ebpf_create_systemd_socket_charts(int update_every)
2292 NETDATA_SERVICES_SOCKET_TCP_V4_CONN_CONTEXT, NETDATA_EBPF_MODULE_NAME_SOCKET,
2293 update_every);
2294
2248 - ebpf_create_charts_on_systemd(NETDATA_NET_APPS_CONNECTION_TCP_V6,
2249 - "Calls to tcp_v6_connection", EBPF_COMMON_DIMENSION_CONNECTIONS,
2250 - NETDATA_APPS_NET_GROUP,
2251 - NETDATA_EBPF_CHART_TYPE_STACKED,
2252 - order++,
2253 - ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
2254 - NETDATA_SERVICES_SOCKET_TCP_V6_CONN_CONTEXT, NETDATA_EBPF_MODULE_NAME_SOCKET,
2255 - update_every);
2295 + if (tcp_v6_connect_address.type == 'T') {
2296 + ebpf_create_charts_on_systemd(NETDATA_NET_APPS_CONNECTION_TCP_V6,
2297 + "Calls to tcp_v6_connection",
2298 + EBPF_COMMON_DIMENSION_CONNECTIONS,
2299 + NETDATA_APPS_NET_GROUP,
2300 + NETDATA_EBPF_CHART_TYPE_STACKED,
2301 + order++,
2302 + ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
2303 + NETDATA_SERVICES_SOCKET_TCP_V6_CONN_CONTEXT,
2304 + NETDATA_EBPF_MODULE_NAME_SOCKET,
2305 + update_every);
2306 + }
2307
2308 ebpf_create_charts_on_systemd(NETDATA_NET_APPS_BANDWIDTH_RECV,
2309 "Bytes received", EBPF_COMMON_DIMENSION_BITS,
@@ -2339,13 +2390,15 @@ static void ebpf_send_systemd_socket_charts()
2390 }
2391 write_end_chart();
2392
2342 - write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_NET_APPS_CONNECTION_TCP_V6);
2343 - for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
2344 - if (unlikely(ect->systemd) && unlikely(ect->updated)) {
2345 - write_chart_dimension(ect->name, (long long)ect->publish_socket.call_tcp_v6_connection);
2393 + if (tcp_v6_connect_address.type == 'T') {
2394 + write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_NET_APPS_CONNECTION_TCP_V6);
2395 + for (ect = ebpf_cgroup_pids; ect; ect = ect->next) {
2396 + if (unlikely(ect->systemd) && unlikely(ect->updated)) {
2397 + write_chart_dimension(ect->name, (long long)ect->publish_socket.call_tcp_v6_connection);
2398 + }
2399 }
2400 + write_end_chart();
2401 }
2348 - write_end_chart();
2402
2403 write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_NET_APPS_BANDWIDTH_SENT);
2404 for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
@@ -2562,6 +2615,8 @@ static void ebpf_socket_initialize_global_vectors()
2615 sizeof(netdata_socket_plus_t));
2616
2617 socket_values = callocz((size_t)ebpf_nprocs, sizeof(netdata_socket_t));
2618 +
2619 + ebpf_load_addresses(&tcp_v6_connect_address, -1);
2620 }
2621
2622 /*****************************************************************
libnetdata/ebpf/ebpf.c
+2
@@ -1367,6 +1367,8 @@ void ebpf_load_addresses(ebpf_addresses_t *fa, int fd)
1367 char *fcnt = procfile_lineword(ff, l, 2);
1368 uint32_t hash = simple_hash(fcnt);
1369 if (fa->hash == hash && !strcmp(fcnt, fa->function)) {
1370 + char *type = procfile_lineword(ff, l, 2);
1371 + fa->type = type[0];
1372 if (fd > 0) {
1373 char addr[128];
1374 snprintf(addr, 127, "0x%s", procfile_lineword(ff, l, 0));
libnetdata/ebpf/ebpf.h
+1
@@ -148,6 +148,7 @@ typedef struct ebpf_addresses {
148 uint32_t hash;
149 // We use long as address, because it matches system length
150 unsigned long addr;
151 + uint32_t type;
152 } ebpf_addresses_t;
153
154 extern char *ebpf_user_config_dir;