eBPF synchronization (#10299)
Co-authored-by: Joel Hans <joel.g.hans@gmail.com>
thiagoftsm committed
Dec 4, 2020 at 08:39 UTC
c195837dfeeda2832b499cf77f0928054e39ace7
7 files changed
+106
-76
collectors/ebpf.plugin/README.md
+9
-9
@@ -175,12 +175,12 @@ When the integration is enabled, your dashboard will also show the following cha
175
- eBPF net
176
- Number of bytes transmited per seconds.
177
178
-If you want to _disable_ the integration with `apps.plugin` along with the above charts, change the setting `disable
179
-apps` to `yes`.
178
+If you want to _disable_ the integration with `apps.plugin` along with the above charts, change the setting `apps` to
179
+`no`.
180
181
```conf
182
[global]
183
- disable apps = yes
183
+ apps = yes
184
```
185
186
### `[ebpf programs]`
@@ -192,12 +192,12 @@ The eBPF collector enables and runs the following eBPF programs by default:
192
- `network viewer`: This eBPF program creates charts with information about `TCP` and `UDP` functions, including the
193
bandwidth consumed by each.
194
195
-### `[network viewer]`
195
+### `[network connections]`
196
197
You can configure the information shown on `outbound` and `inbound` charts with the settings in this section.
198
199
```conf
200
-[network viewer]
200
+[network connections]
201
maximum dimensions = 500
202
resolve hostname ips = no
203
ports = 1-1024 !145 !domain
@@ -221,8 +221,8 @@ The following options are available:
221
range of IPs, or use CIDR values. The default behavior is to only collect data for private IP addresess, but this
222
can be changed with the `ips` setting.
223
224
-By default, Netdata displays up to 500 dimensions on network viewer charts. If there are more possible dimensions, they
225
-will be bundled into the `other` dimension. You can increase the number of shown dimensions by changing the `maximum
224
+By default, Netdata displays up to 500 dimensions on network connection charts. If there are more possible dimensions,
225
+they will be bundled into the `other` dimension. You can increase the number of shown dimensions by changing the `maximum
226
dimensions` setting.
227
228
The dimensions for the traffic charts are created using the destination IPs of the sockets by default. This can be
@@ -231,11 +231,11 @@ the `hostnames` every time that is possible to resolve IPs to their hostnames.
231
232
### `[service name]`
233
234
-Netdata uses the list of services in `/etc/services` to plot network viewer charts. If this file does not contain the
234
+Netdata uses the list of services in `/etc/services` to plot network connection charts. If this file does not contain the
235
name for a particular service you use in your infrastructure, you will need to add it to the `[service name]` section.
236
237
For example, Netdata's default port (`19999`) is not listed in `/etc/services`. To associate that port with the Netdata
238
-service in network viewer charts, and thus see the name of the service instead of its port, define it:
238
+service in network connection charts, and thus see the name of the service instead of its port, define it:
239
240
```conf
241
[service name]
collectors/ebpf.plugin/ebpf.c
+28
-29
@@ -107,7 +107,7 @@ ebpf_module_t ebpf_modules[] = {
107
{ .thread_name = "process", .config_name = "process", .enabled = 0, .start_routine = ebpf_process_thread,
108
.update_time = 1, .global_charts = 1, .apps_charts = 1, .mode = MODE_ENTRY, .probes = process_probes,
109
.optional = 0 },
110
- { .thread_name = "socket", .config_name = "network viewer", .enabled = 0, .start_routine = ebpf_socket_thread,
110
+ { .thread_name = "socket", .config_name = "socket", .enabled = 0, .start_routine = ebpf_socket_thread,
111
.update_time = 1, .global_charts = 1, .apps_charts = 1, .mode = MODE_ENTRY, .probes = socket_probes,
112
.optional = 0 },
113
{ .thread_name = NULL, .enabled = 0, .start_routine = NULL, .update_time = 1,
@@ -862,25 +862,6 @@ static inline void how_to_load(char *ptr)
862
error("the option %s for \"ebpf load mode\" is not a valid option.", ptr);
863
}
864
865
-/**
866
- * Parse disable apps option
867
- *
868
- * @param ptr the option given by users
869
- *
870
- * @return It returns 1 to disable the charts or 0 otherwise.
871
- */
872
-static inline int parse_disable_apps(char *ptr)
873
-{
874
- if (!strcasecmp(ptr, "yes")) {
875
- ebpf_disable_apps();
876
- return 1;
877
- } else if (strcasecmp(ptr, "no") != 0) {
878
- error("The option %s for \"disable apps\" is not a valid option.", ptr);
879
- }
880
-
881
- return 0;
882
-}
883
-
865
/**
866
* Fill Port list
867
*
@@ -1556,12 +1537,12 @@ static void parse_network_viewer_section()
1537
network_viewer_opt.hostname_resolution_enabled = appconfig_get_boolean(&collector_config,
1538
EBPF_NETWORK_VIEWER_SECTION,
1539
"resolve hostnames",
1559
- 0);
1540
+ CONFIG_BOOLEAN_NO);
1541
1542
network_viewer_opt.service_resolution_enabled = appconfig_get_boolean(&collector_config,
1543
EBPF_NETWORK_VIEWER_SECTION,
1544
"resolve service names",
1564
- 0);
1545
+ CONFIG_BOOLEAN_NO);
1546
1547
char *value = appconfig_get(&collector_config, EBPF_NETWORK_VIEWER_SECTION,
1548
"ports", NULL);
@@ -1575,7 +1556,7 @@ static void parse_network_viewer_section()
1556
}
1557
1558
value = appconfig_get(&collector_config, EBPF_NETWORK_VIEWER_SECTION,
1578
- "ips", "!127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 fc00::/7");
1559
+ "ips", "!127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 fc00::/7 !::1/128");
1560
parse_ips(value);
1561
}
1562
@@ -1674,19 +1655,33 @@ static void read_collector_values(int *disable_apps)
1655
1656
how_to_load(value);
1657
1677
- value = appconfig_get(&collector_config, EBPF_GLOBAL_SECTION, "disable apps", "no");
1678
- *disable_apps = parse_disable_apps(value);
1658
+ // This is kept to keep compatibility
1659
+ uint32_t enabled = appconfig_get_boolean(&collector_config, EBPF_GLOBAL_SECTION, "disable apps",
1660
+ CONFIG_BOOLEAN_NO);
1661
+ if (!enabled) {
1662
+ // Apps is a positive sentence, so we need to invert the values to disable apps.
1663
+ enabled = appconfig_get_boolean(&collector_config, EBPF_GLOBAL_SECTION, "apps",
1664
+ CONFIG_BOOLEAN_YES);
1665
+ enabled = (enabled == CONFIG_BOOLEAN_NO)?CONFIG_BOOLEAN_YES:CONFIG_BOOLEAN_NO;
1666
+ }
1667
+ *disable_apps = (int)enabled;
1668
1669
// Read ebpf programs section
1681
- uint32_t enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, ebpf_modules[0].config_name,
1682
- 1);
1670
+ enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION,
1671
+ ebpf_modules[0].config_name, CONFIG_BOOLEAN_YES);
1672
int started = 0;
1673
if (enabled) {
1674
ebpf_enable_chart(EBPF_MODULE_PROCESS_IDX, *disable_apps);
1675
started++;
1676
}
1677
1689
- enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, ebpf_modules[1].config_name, 1);
1678
+ // This is kept to keep compatibility
1679
+ enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, "network viewer",
1680
+ CONFIG_BOOLEAN_NO);
1681
+ if (!enabled)
1682
+ enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, ebpf_modules[1].config_name,
1683
+ CONFIG_BOOLEAN_NO);
1684
+
1685
if (enabled) {
1686
ebpf_enable_chart(EBPF_MODULE_SOCKET_IDX, *disable_apps);
1687
// Read network viewer section if network viewer is enabled
@@ -1695,8 +1690,12 @@ static void read_collector_values(int *disable_apps)
1690
started++;
1691
}
1692
1693
+ // This is kept to keep compatibility
1694
enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, "network connection monitoring",
1699
- 0);
1695
+ CONFIG_BOOLEAN_NO);
1696
+ if (!enabled)
1697
+ enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, "network connections",
1698
+ CONFIG_BOOLEAN_NO);
1699
ebpf_modules[1].optional = enabled;
1700
1701
if (!started){
collectors/ebpf.plugin/ebpf.conf
+31
-5
@@ -1,18 +1,44 @@
1
+#
2
+# Global options
3
+#
4
+# The `ebpf load mode` option accepts the following values :
5
+# `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
6
+# `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
7
+# new charts for the return of these functions, such as errors.
8
+#
9
+# The eBPF collector also creates charts for each running application through an integration with the `apps plugin`.
10
+# If you want to disable the integration with `apps.plugin` along with the above charts, change the setting `apps` to
11
+# 'no'.
12
+#
13
[global]
14
ebpf load mode = entry
3
- disable apps = no
15
+ apps = yes
16
17
+#
18
+# eBPF Programs
19
+#
20
+# The eBPF collector enables and runs the following eBPF programs by default:
21
+#
22
+# `process` : This eBPF program creates charts that show information about process creation, VFS IO, and
23
+# files removed.
24
+# `socket` : This eBPF program creates charts with information about `TCP` and `UDP` functions, including the
25
+# bandwidth consumed by each.
26
[ebpf programs]
27
process = yes
7
- network viewer = yes
8
- network connection monitoring = no
28
+ socket = yes
29
+ network connections = no
30
10
-[network viewer]
31
+#
32
+# Network Connection
33
+#
34
+# This is a feature with status WIP(Work in Progress)
35
+#
36
+[network connections]
37
maximum dimensions = 50
38
resolve hostnames = no
39
resolve service names = no
40
ports = *
15
- ips = !127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 fc00::/7
41
+ ips = !127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 fc00::/7 !::1/128
42
hostnames = *
43
44
[service name]
collectors/ebpf.plugin/ebpf.h
+1
-1
@@ -167,7 +167,7 @@ extern void write_end_chart();
167
168
#define EBPF_GLOBAL_SECTION "global"
169
#define EBPF_PROGRAMS_SECTION "ebpf programs"
170
-#define EBPF_NETWORK_VIEWER_SECTION "network viewer"
170
+#define EBPF_NETWORK_VIEWER_SECTION "network connections"
171
#define EBPF_SERVICE_NAME_SECTION "service name"
172
173
#define EBPF_COMMON_DIMENSION_CALL "calls"
collectors/ebpf.plugin/ebpf_apps.h
+3
-1
@@ -11,7 +11,9 @@
11
#include "libnetdata/ebpf/ebpf.h"
12
13
#define NETDATA_APPS_FAMILY "apps"
14
-#define NETDATA_APPS_SYSCALL_GROUP "ebpf syscall"
14
+#define NETDATA_APPS_FILE_GROUP "ebpf file"
15
+#define NETDATA_APPS_VFS_GROUP "ebpf vfs"
16
+#define NETDATA_APPS_PROCESS_GROUP "ebpf process"
17
#define NETDATA_APPS_NET_GROUP "ebpf net"
18
19
#include "ebpf_process.h"
collectors/ebpf.plugin/ebpf_process.c
+14
-14
@@ -659,7 +659,7 @@ static void ebpf_process_create_apps_charts(ebpf_module_t *em, struct target *ro
659
ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_FILE_OPEN,
660
"Number of open files",
661
EBPF_COMMON_DIMENSION_CALL,
662
- NETDATA_APPS_SYSCALL_GROUP,
662
+ NETDATA_APPS_FILE_GROUP,
663
20061,
664
root);
665
@@ -667,7 +667,7 @@ static void ebpf_process_create_apps_charts(ebpf_module_t *em, struct target *ro
667
ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_FILE_OPEN_ERROR,
668
"Fails to open files",
669
EBPF_COMMON_DIMENSION_CALL,
670
- NETDATA_APPS_SYSCALL_GROUP,
670
+ NETDATA_APPS_FILE_GROUP,
671
20062,
672
root);
673
}
@@ -675,7 +675,7 @@ static void ebpf_process_create_apps_charts(ebpf_module_t *em, struct target *ro
675
ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_FILE_CLOSED,
676
"Files closed",
677
EBPF_COMMON_DIMENSION_CALL,
678
- NETDATA_APPS_SYSCALL_GROUP,
678
+ NETDATA_APPS_FILE_GROUP,
679
20063,
680
root);
681
@@ -683,7 +683,7 @@ static void ebpf_process_create_apps_charts(ebpf_module_t *em, struct target *ro
683
ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_FILE_CLOSE_ERROR,
684
"Fails to close files",
685
EBPF_COMMON_DIMENSION_CALL,
686
- NETDATA_APPS_SYSCALL_GROUP,
686
+ NETDATA_APPS_FILE_GROUP,
687
20064,
688
root);
689
}
@@ -691,14 +691,14 @@ static void ebpf_process_create_apps_charts(ebpf_module_t *em, struct target *ro
691
ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_FILE_DELETED,
692
"Files deleted",
693
EBPF_COMMON_DIMENSION_CALL,
694
- NETDATA_APPS_SYSCALL_GROUP,
694
+ NETDATA_APPS_VFS_GROUP,
695
20065,
696
root);
697
698
ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS,
699
"Write to disk",
700
EBPF_COMMON_DIMENSION_CALL,
701
- NETDATA_APPS_SYSCALL_GROUP,
701
+ NETDATA_APPS_VFS_GROUP,
702
20066,
703
apps_groups_root_target);
704
@@ -706,7 +706,7 @@ static void ebpf_process_create_apps_charts(ebpf_module_t *em, struct target *ro
706
ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS_ERROR,
707
"Fails to write",
708
EBPF_COMMON_DIMENSION_CALL,
709
- NETDATA_APPS_SYSCALL_GROUP,
709
+ NETDATA_APPS_VFS_GROUP,
710
20067,
711
root);
712
}
@@ -714,7 +714,7 @@ static void ebpf_process_create_apps_charts(ebpf_module_t *em, struct target *ro
714
ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_READ_CALLS,
715
"Read from disk",
716
EBPF_COMMON_DIMENSION_CALL,
717
- NETDATA_APPS_SYSCALL_GROUP,
717
+ NETDATA_APPS_VFS_GROUP,
718
20068,
719
root);
720
@@ -722,7 +722,7 @@ static void ebpf_process_create_apps_charts(ebpf_module_t *em, struct target *ro
722
ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_READ_CALLS_ERROR,
723
"Fails to read",
724
EBPF_COMMON_DIMENSION_CALL,
725
- NETDATA_APPS_SYSCALL_GROUP,
725
+ NETDATA_APPS_VFS_GROUP,
726
20069,
727
root);
728
}
@@ -730,35 +730,35 @@ static void ebpf_process_create_apps_charts(ebpf_module_t *em, struct target *ro
730
ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_WRITE_BYTES,
731
"Bytes written on disk",
732
EBPF_COMMON_DIMENSION_BYTESS,
733
- NETDATA_APPS_SYSCALL_GROUP,
733
+ NETDATA_APPS_VFS_GROUP,
734
20070,
735
root);
736
737
ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_READ_BYTES,
738
"Bytes read from disk",
739
EBPF_COMMON_DIMENSION_BYTESS,
740
- NETDATA_APPS_SYSCALL_GROUP,
740
+ NETDATA_APPS_VFS_GROUP,
741
20071,
742
root);
743
744
ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_TASK_PROCESS,
745
"Process started",
746
EBPF_COMMON_DIMENSION_CALL,
747
- NETDATA_APPS_SYSCALL_GROUP,
747
+ NETDATA_APPS_PROCESS_GROUP,
748
20072,
749
root);
750
751
ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_TASK_THREAD,
752
"Threads started",
753
EBPF_COMMON_DIMENSION_CALL,
754
- NETDATA_APPS_SYSCALL_GROUP,
754
+ NETDATA_APPS_PROCESS_GROUP,
755
20073,
756
root);
757
758
ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_TASK_CLOSE,
759
"Tasks closed",
760
EBPF_COMMON_DIMENSION_CALL,
761
- NETDATA_APPS_SYSCALL_GROUP,
761
+ NETDATA_APPS_PROCESS_GROUP,
762
20074,
763
root);
764
}
web/gui/dashboard_info.js
+20
-17
@@ -1105,67 +1105,70 @@ netdataDashboard.context = {
1105
},
1106
1107
'apps.file_open': {
1108
- height: 2.0
1108
+ info: 'Calls to the internal function <code>do_sys_open</code>, which is the common function called from' +
1109
+ ' <a href="https://www.man7.org/linux/man-pages/man2/open.2.html" target="_blank">open(2)</a> ' +
1110
+ ' and <a href="https://www.man7.org/linux/man-pages/man2/openat.2.html" target="_blank">openat(2)</a>. '
1111
},
1112
1113
'apps.file_open_error': {
1112
- height: 2.0
1114
+ info: 'Failed calls to the internal function <code>do_sys_open</code>.'
1115
},
1116
1117
'apps.file_closed': {
1116
- height: 2.0
1118
+ info: 'Calls to the internal function <code>__close_fd</code>, which is called from' +
1119
+ ' <a href="https://www.man7.org/linux/man-pages/man2/close.2.html" target="_blank">close(2)</a>. '
1120
},
1121
1122
'apps.file_close_error': {
1120
- height: 2.0
1123
+ info: 'Failed calls to the internal function <code>__close_fd</code>.'
1124
},
1125
1126
'apps.file_deleted': {
1124
- height: 2.0
1127
+ info: 'Calls to the function <code>vfs_unlink</code>. This chart does not show all events that remove files from the filesystem, because filesystems can create their own functions to remove files.'
1128
},
1129
1130
'apps.vfs_write_call': {
1128
- height: 2.0
1131
+ info: 'Successful calls to the function <code>vfs_write</code>. This chart may not show all filesystem events if it uses other functions to store data on disk.'
1132
},
1133
1134
'apps.vfs_write_error': {
1132
- height: 2.0
1135
+ info: 'Failed calls to the function <code>vfs_write</code>. This chart may not show all filesystem events if it uses other functions to store data on disk.'
1136
},
1137
1138
'apps.vfs_read_call': {
1136
- height: 2.0
1139
+ info: 'Successful calls to the function <code>vfs_read</code>. This chart may not show all filesystem events if it uses other functions to store data on disk.'
1140
},
1141
1142
'apps.vfs_read_error': {
1140
- height: 2.0
1143
+ info: 'Failed calls to the function <code>vfs_read</code>. This chart may not show all filesystem events if it uses other functions to store data on disk.'
1144
},
1145
1146
'apps.vfs_write_bytes': {
1144
- height: 2.0
1147
+ info: 'Total of bytes successfully written using the function <code>vfs_write</code>.'
1148
},
1149
1150
'apps.vfs_read_bytes': {
1148
- height: 2.0
1151
+ info: 'Total of bytes successfully read using the function <code>vfs_read</code>.'
1152
},
1153
1154
'apps.process_create': {
1152
- height: 2.0
1155
+ info: 'Calls to the function <code>do_fork</code> to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the process by counting the number of calls to <code>sys_clone</code> that do not have the flag <code>CLONE_THREAD</code> set.'
1156
},
1157
1158
'apps.thread_create': {
1156
- height: 2.0
1159
+ info: 'Calls to the function <code>do_fork</code> to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the threads by counting the number of calls to <code>sys_clone</code> that have the flag <code>CLONE_THREAD</code> set.'
1160
},
1161
1162
'apps.task_close': {
1160
- height: 2.0
1163
+ info: 'Calls to the functions responsible for closing (<code>do_exit</code>) and releasing (<code>release_task</code>) tasks.'
1164
},
1165
1166
'apps.bandwidth_sent': {
1164
- height: 2.0
1167
+ info: 'Bytes sent by functions <code>tcp_sendmsg</code> and <code>udp_sendmsg</code>.'
1168
},
1169
1170
'apps.bandwidth_recv': {
1168
- height: 2.0
1171
+ info: 'Bytes received by functions <code>tcp_cleanup_rbuf</code> and <code>udp_recvmsg</code>.'
1172
},
1173
1174
// ------------------------------------------------------------------------
@@ -3302,7 +3305,7 @@ netdataDashboard.context = {
3305
3306
'ebpf.io_bytes': {
3307
title : 'VFS bytes written',
3305
- info: 'Total of bytes read or written with success using the functions <code>vfs_read</code> and <code>vfs_write</code>.'
3308
+ info: 'Total of bytes read or written with success using the functions <code>vfs_read</code> and <code>vfs_write</code>.'
3309
},
3310
3311
'ebpf.io_error': {