@cryptotaxi247 / netdata-1 / commits / d322b1338

Modify PID monitoring (ebpf.plugin) (#13397)

thiagoftsm committed Aug 12, 2022 at 13:15 UTC d322b13381d3c8f2f4032f5ae645119710f22477

18 files changed +194 -79

collectors/ebpf.plugin/ebpf.c

+47 -45

@@ -35,132 +35,134 @@ pthread_cond_t collect_data_cond_var;

35 ebpf_module_t ebpf_modules[] = {

36 { .thread_name = "process", .config_name = "process", .enabled = 0, .start_routine = ebpf_process_thread,

37 .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,

38 - .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

38 + .apps_level = NETDATA_APPS_LEVEL_REAL_PARENT, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

39 .apps_routine = ebpf_process_create_apps_charts, .maps = NULL,

40 .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &process_config,

41 .config_file = NETDATA_PROCESS_CONFIG_FILE,

43 + NETDATA_V5_14,

44 .load = EBPF_LOAD_LEGACY, .targets = NULL, .probe_links = NULL, .objects = NULL},

45 { .thread_name = "socket", .config_name = "socket", .enabled = 0, .start_routine = ebpf_socket_thread,

46 .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,

46 - .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

47 + .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

48 .apps_routine = ebpf_socket_create_apps_charts, .maps = NULL,

49 .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &socket_config,

50 .config_file = NETDATA_NETWORK_CONFIG_FILE,

50 - .kernels = NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4,

52 .load = EBPF_LOAD_LEGACY, .targets = socket_targets, .probe_links = NULL, .objects = NULL},

53 { .thread_name = "cachestat", .config_name = "cachestat", .enabled = 0, .start_routine = ebpf_cachestat_thread,

54 .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,

54 - .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

55 - .apps_routine = ebpf_cachestat_create_apps_charts, .maps = NULL,

55 + .apps_level = NETDATA_APPS_LEVEL_REAL_PARENT, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

56 + .apps_routine = ebpf_cachestat_create_apps_charts, .maps = cachestat_maps,

57 .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &cachestat_config,

58 .config_file = NETDATA_CACHESTAT_CONFIG_FILE,

59 - NETDATA_V5_16,

59 + .kernels = NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18|

60 + NETDATA_V5_4 | NETDATA_V5_14 | NETDATA_V5_15 | NETDATA_V5_16,

61 .load = EBPF_LOAD_LEGACY, .targets = cachestat_targets, .probe_links = NULL, .objects = NULL},

62 { .thread_name = "sync", .config_name = "sync", .enabled = 0, .start_routine = ebpf_sync_thread,

63 .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,

63 - .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0, .apps_routine = NULL, .maps = NULL,

64 - .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &sync_config,

64 + .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

65 + .apps_routine = NULL, .maps = NULL, .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &sync_config,

66 .config_file = NETDATA_SYNC_CONFIG_FILE,

67 // All syscalls have the same kernels

67 - .kernels = NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4,

69 .load = EBPF_LOAD_LEGACY, .targets = sync_targets, .probe_links = NULL, .objects = NULL},

70 { .thread_name = "dc", .config_name = "dc", .enabled = 0, .start_routine = ebpf_dcstat_thread,

71 .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,

71 - .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

72 - .apps_routine = ebpf_dcstat_create_apps_charts, .maps = NULL,

72 + .apps_level = NETDATA_APPS_LEVEL_REAL_PARENT, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

73 + .apps_routine = ebpf_dcstat_create_apps_charts, .maps = dcstat_maps,

74 .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &dcstat_config,

75 .config_file = NETDATA_DIRECTORY_DCSTAT_CONFIG_FILE,

75 - .kernels = NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4,

77 .load = EBPF_LOAD_LEGACY, .targets = dc_targets, .probe_links = NULL, .objects = NULL},

78 { .thread_name = "swap", .config_name = "swap", .enabled = 0, .start_routine = ebpf_swap_thread,

79 .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,

79 - .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

80 + .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

81 .apps_routine = ebpf_swap_create_apps_charts, .maps = NULL,

82 .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &swap_config,

83 .config_file = NETDATA_DIRECTORY_SWAP_CONFIG_FILE,

83 - .kernels = NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4,

85 .load = EBPF_LOAD_LEGACY, .targets = swap_targets, .probe_links = NULL, .objects = NULL},

86 { .thread_name = "vfs", .config_name = "vfs", .enabled = 0, .start_routine = ebpf_vfs_thread,

87 .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,

87 - .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

88 + .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

89 .apps_routine = ebpf_vfs_create_apps_charts, .maps = NULL,

90 .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &vfs_config,

91 .config_file = NETDATA_DIRECTORY_VFS_CONFIG_FILE,

91 - .kernels = NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4,

93 .load = EBPF_LOAD_LEGACY, .targets = NULL, .probe_links = NULL, .objects = NULL},

94 { .thread_name = "filesystem", .config_name = "filesystem", .enabled = 0, .start_routine = ebpf_filesystem_thread,

95 .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,

95 - .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0, .apps_routine = NULL, .maps = NULL,

96 - .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &fs_config,

96 + .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

97 + .apps_routine = NULL, .maps = NULL, .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &fs_config,

98 .config_file = NETDATA_FILESYSTEM_CONFIG_FILE,

99 //We are setting kernels as zero, because we load eBPF programs according the kernel running.

100 .kernels = 0, .load = EBPF_LOAD_LEGACY, .targets = NULL, .probe_links = NULL, .objects = NULL },

101 { .thread_name = "disk", .config_name = "disk", .enabled = 0, .start_routine = ebpf_disk_thread,

102 .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,

102 - .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0, .apps_routine = NULL, .maps = NULL,

103 - .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &disk_config,

103 + .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

104 + .apps_routine = NULL, .maps = NULL, .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &disk_config,

105 .config_file = NETDATA_DISK_CONFIG_FILE,

105 - .kernels = NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4,

107 .load = EBPF_LOAD_LEGACY, .targets = NULL, .probe_links = NULL, .objects = NULL},

108 { .thread_name = "mount", .config_name = "mount", .enabled = 0, .start_routine = ebpf_mount_thread,

109 .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,

109 - .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0, .apps_routine = NULL, .maps = NULL,

110 - .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &mount_config,

110 + .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

111 + .apps_routine = NULL, .maps = NULL, .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &mount_config,

112 .config_file = NETDATA_MOUNT_CONFIG_FILE,

112 - .kernels = NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4,

114 .load = EBPF_LOAD_LEGACY, .targets = mount_targets, .probe_links = NULL, .objects = NULL},

115 { .thread_name = "fd", .config_name = "fd", .enabled = 0, .start_routine = ebpf_fd_thread,

116 .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,

116 - .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

117 + .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

118 .apps_routine = ebpf_fd_create_apps_charts, .maps = NULL,

119 .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &fd_config,

120 .config_file = NETDATA_FD_CONFIG_FILE,

122 + NETDATA_V5_14,

123 .load = EBPF_LOAD_LEGACY, .targets = NULL, .probe_links = NULL, .objects = NULL},

124 { .thread_name = "hardirq", .config_name = "hardirq", .enabled = 0, .start_routine = ebpf_hardirq_thread,

125 .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,

124 - .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0, .apps_routine = NULL, .maps = NULL,

125 - .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &hardirq_config,

126 + .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

127 + .apps_routine = NULL, .maps = NULL, .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &hardirq_config,

128 .config_file = NETDATA_HARDIRQ_CONFIG_FILE,

127 - .kernels = NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4,

130 .load = EBPF_LOAD_LEGACY, .targets = NULL, .probe_links = NULL, .objects = NULL},

131 { .thread_name = "softirq", .config_name = "softirq", .enabled = 0, .start_routine = ebpf_softirq_thread,

132 .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,

131 - .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0, .apps_routine = NULL, .maps = NULL,

132 - .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &softirq_config,

133 + .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

134 + .apps_routine = NULL, .maps = NULL, .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &softirq_config,

135 .config_file = NETDATA_SOFTIRQ_CONFIG_FILE,

134 - .kernels = NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4,

137 .load = EBPF_LOAD_LEGACY, .targets = NULL, .probe_links = NULL, .objects = NULL},

138 { .thread_name = "oomkill", .config_name = "oomkill", .enabled = 0, .start_routine = ebpf_oomkill_thread,

139 .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,

138 - .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

140 + .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

141 .apps_routine = ebpf_oomkill_create_apps_charts, .maps = NULL,

142 .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &oomkill_config,

143 .config_file = NETDATA_OOMKILL_CONFIG_FILE,

142 - .kernels = NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4,

145 .load = EBPF_LOAD_LEGACY, .targets = NULL, .probe_links = NULL, .objects = NULL},

146 { .thread_name = "shm", .config_name = "shm", .enabled = 0, .start_routine = ebpf_shm_thread,

147 .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,

146 - .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

148 + .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

149 .apps_routine = ebpf_shm_create_apps_charts, .maps = NULL,

150 .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &shm_config,

151 .config_file = NETDATA_DIRECTORY_SHM_CONFIG_FILE,

150 - .kernels = NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4,

153 .load = EBPF_LOAD_LEGACY, .targets = shm_targets, .probe_links = NULL, .objects = NULL},

154 { .thread_name = "mdflush", .config_name = "mdflush", .enabled = 0, .start_routine = ebpf_mdflush_thread,

155 .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,

154 - .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0, .apps_routine = NULL, .maps = NULL,

155 - .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &mdflush_config,

156 + .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,

157 + .apps_routine = NULL, .maps = NULL, .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &mdflush_config,

158 .config_file = NETDATA_DIRECTORY_MDFLUSH_CONFIG_FILE,

157 - .kernels = NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4,

160 .load = EBPF_LOAD_LEGACY, .targets = NULL, .probe_links = NULL, .objects = NULL},

161 { .thread_name = NULL, .enabled = 0, .start_routine = NULL, .update_every = EBPF_DEFAULT_UPDATE_EVERY,

160 - .global_charts = 0, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO, .cgroup_charts = CONFIG_BOOLEAN_NO,

161 - .mode = MODE_ENTRY, .optional = 0, .apps_routine = NULL, .maps = NULL, .pid_map_size = 0, .names = NULL,

162 - .cfg = NULL, .config_name = NULL, .kernels = 0, .load = EBPF_LOAD_LEGACY, .targets = NULL, .probe_links = NULL,

163 - .objects = NULL},

162 + .global_charts = 0, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO, .apps_level = NETDATA_APPS_NOT_SET,

163 + .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0, .apps_routine = NULL, .maps = NULL,

164 + .pid_map_size = 0, .names = NULL, .cfg = NULL, .config_name = NULL, .kernels = 0, .load = EBPF_LOAD_LEGACY,

165 + .targets = NULL, .probe_links = NULL, .objects = NULL},

166 };

167

168 struct netdata_static_thread ebpf_threads[] = {

collectors/ebpf.plugin/ebpf.d/cachestat.conf

@@ -19,6 +19,11 @@

19 # `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host.

20 # `probe` : This is the same as legacy code.

21 #

22 +# The `collect pid` option defines the PID stored inside hash tables and accepts the following options:

23 +# `real parent`: Only stores real parent inside PID

24 +# `parent` : Only stores parent PID.

25 +# `all` : Stores all PIDs used by software. This is the most expensive option.

26 +#

27 # Uncomment lines to define specific options for thread.

28 [global]

29 # ebpf load mode = entry

@@ -28,3 +33,4 @@

33 # pid table size = 32768

34 ebpf type format = auto

35 ebpf co-re tracing = trampoline

36 + collect pid = real parent

collectors/ebpf.plugin/ebpf.d/dcstat.conf

@@ -17,6 +17,11 @@

17 # `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host.

18 # `probe` : This is the same as legacy code.

19 #

20 +# The `collect pid` option defines the PID stored inside hash tables and accepts the following options:

21 +# `real parent`: Only stores real parent inside PID

22 +# `parent` : Only stores parent PID.

23 +# `all` : Stores all PIDs used by software. This is the most expensive option.

24 +#

25 # Uncomment lines to define specific options for thread.

26 [global]

27 # ebpf load mode = entry

@@ -26,3 +31,4 @@

31 # pid table size = 32768

32 ebpf type format = auto

33 ebpf co-re tracing = trampoline

34 + collect pid = real parent

collectors/ebpf.plugin/ebpf.d/process.conf

@@ -9,6 +9,11 @@

9 # the setting `apps` and `cgroups` to 'no'.

10 #

11 # The `pid table size` defines the maximum number of PIDs stored inside the hash table.

12 +#

13 +# The `collect pid` option defines the PID stored inside hash tables and accepts the following options:

14 +# `real parent`: Only stores real parent inside PID

15 +# `parent` : Only stores parent PID.

16 +# `all` : Stores all PIDs used by software. This is the most expensive option.

17 #

18 # Uncomment lines to define specific options for thread.

19 #[global]

@@ -17,3 +22,4 @@

22 # cgroups = no

23 # update every = 10

24 # pid table size = 32768

25 +# collect pid = real parent

collectors/ebpf.plugin/ebpf_cachestat.c

+3 -3

@@ -19,7 +19,7 @@ struct netdata_static_thread cachestat_threads = {"CACHESTAT KERNEL",

19 NULL, NULL, 1, NULL,

20 NULL, NULL};

22 -static ebpf_local_maps_t cachestat_maps[] = {{.name = "cstat_global", .internal_input = NETDATA_CACHESTAT_END,

22 +ebpf_local_maps_t cachestat_maps[] = {{.name = "cstat_global", .internal_input = NETDATA_CACHESTAT_END,

23 .user_input = 0, .type = NETDATA_EBPF_MAP_STATIC,

24 .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},

25 {.name = "cstat_pid", .internal_input = ND_EBPF_DEFAULT_PID_SIZE,

@@ -266,13 +266,13 @@ static inline int ebpf_cachestat_load_and_attach(struct cachestat_bpf *obj, ebpf

266 ebpf_cachestat_disable_specific_probe(obj);

267 }

268

269 + ebpf_cachestat_adjust_map_size(obj, em);

270 +

271 int ret = cachestat_bpf__load(obj);

272 if (ret) {

273 return ret;

274 }

275

274 - ebpf_cachestat_adjust_map_size(obj, em);

275 -

276 ret = (test == EBPF_LOAD_TRAMPOLINE) ? cachestat_bpf__attach(obj) : ebpf_cachestat_attach_probe(obj);

277 if (!ret) {

278 ebpf_cachestat_set_hash_tables(obj);

collectors/ebpf.plugin/ebpf_cachestat.h

@@ -85,5 +85,6 @@ extern void *ebpf_cachestat_thread(void *ptr);

86 extern struct config cachestat_config;

87 extern netdata_ebpf_targets_t cachestat_targets[];

88 +extern ebpf_local_maps_t cachestat_maps[];

90 #endif // NETDATA_EBPF_CACHESTAT_H

collectors/ebpf.plugin/ebpf_dcstat.c

+3 -3

@@ -24,7 +24,7 @@ struct netdata_static_thread dcstat_threads = {"DCSTAT KERNEL",

24 NULL, NULL};

25 static enum ebpf_threads_status ebpf_dcstat_exited = NETDATA_THREAD_EBPF_RUNNING;

27 -static ebpf_local_maps_t dcstat_maps[] = {{.name = "dcstat_global", .internal_input = NETDATA_DIRECTORY_CACHE_END,

27 +ebpf_local_maps_t dcstat_maps[] = {{.name = "dcstat_global", .internal_input = NETDATA_DIRECTORY_CACHE_END,

28 .user_input = 0, .type = NETDATA_EBPF_MAP_STATIC,

29 .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},

30 {.name = "dcstat_pid", .internal_input = ND_EBPF_DEFAULT_PID_SIZE,

@@ -200,13 +200,13 @@ static inline int ebpf_dc_load_and_attach(struct dc_bpf *obj, ebpf_module_t *em)

200 ebpf_dc_disable_trampoline(obj);

201 }

202

203 + ebpf_dc_adjust_map_size(obj, em);

204 +

205 int ret = dc_bpf__load(obj);

206 if (ret) {

207 return ret;

208 }

209

208 - ebpf_dc_adjust_map_size(obj, em);

209 -

210 ret = (test == EBPF_LOAD_TRAMPOLINE) ? dc_bpf__attach(obj) : ebpf_dc_attach_probes(obj);

211 if (!ret) {

212 ebpf_dc_set_hash_tables(obj);

collectors/ebpf.plugin/ebpf_dcstat.h

@@ -79,5 +79,6 @@ extern void *ebpf_dcstat_thread(void *ptr);

79 extern void ebpf_dcstat_create_apps_charts(struct ebpf_module *em, void *ptr);

80 extern struct config dcstat_config;

81 extern netdata_ebpf_targets_t dc_targets[];

82 +extern ebpf_local_maps_t dcstat_maps[];

84 #endif // NETDATA_EBPF_DCSTAT_H

libnetdata/ebpf/ebpf.c

+88 -16

@@ -279,7 +279,8 @@ static char *ebpf_select_kernel_name(uint32_t selector)

279 {

280 static char *kernel_names[] = { NETDATA_IDX_STR_V3_10, NETDATA_IDX_STR_V4_14, NETDATA_IDX_STR_V4_16,

281 NETDATA_IDX_STR_V4_18, NETDATA_IDX_STR_V5_4, NETDATA_IDX_STR_V5_10,

282 - NETDATA_IDX_STR_V5_11, NETDATA_IDX_STR_V5_15, NETDATA_IDX_STR_V5_16

282 + NETDATA_IDX_STR_V5_11, NETDATA_IDX_STR_V5_14, NETDATA_IDX_STR_V5_15,

283 + NETDATA_IDX_STR_V5_16

284 };

285

286 return kernel_names[selector];

@@ -298,7 +299,9 @@ static char *ebpf_select_kernel_name(uint32_t selector)

299 static int ebpf_select_max_index(int is_rhf, uint32_t kver)

300 {

301 if (is_rhf > 0) { // Is Red Hat family

301 - if (kver >= NETDATA_EBPF_KERNEL_4_11)

302 + if (kver >= NETDATA_EBPF_KERNEL_5_14)

303 + return NETDATA_IDX_V5_14;

304 + else if (kver >= NETDATA_EBPF_KERNEL_4_11)

305 return NETDATA_IDX_V4_18;

306 } else { // Kernels from kernel.org

307 if (kver >= NETDATA_EBPF_KERNEL_5_16)

@@ -334,6 +337,9 @@ static uint32_t ebpf_select_index(uint32_t kernels, int is_rhf, uint32_t kver)

337 uint32_t start = ebpf_select_max_index(is_rhf, kver);

338 uint32_t idx;

339

340 + if (is_rhf == -1)

341 + kernels &= ~NETDATA_V5_14;

342 +

343 for (idx = start; idx; idx--) {

344 if (kernels & 1 << idx)

345 break;

@@ -465,24 +471,40 @@ void ebpf_update_pid_table(ebpf_local_maps_t *pid, ebpf_module_t *em)

471 */

472 void ebpf_update_map_size(struct bpf_map *map, ebpf_local_maps_t *lmap, ebpf_module_t *em, const char *map_name)

473 {

474 + uint32_t define_size = 0;

475 uint32_t apps_type = NETDATA_EBPF_MAP_PID | NETDATA_EBPF_MAP_RESIZABLE;

476 if (lmap->user_input && lmap->user_input != lmap->internal_input) {

477 + define_size = lmap->internal_input;

478 #ifdef NETDATA_INTERNAL_CHECKS

479 info("Changing map %s from size %u to %u ", map_name, lmap->internal_input, lmap->user_input);

472 -#endif

473 -#ifdef LIBBPF_MAJOR_VERSION

474 - bpf_map__set_max_entries(map, lmap->user_input);

475 -#else

476 - bpf_map__resize(map, lmap->user_input);

480 #endif

481 } else if (((lmap->type & apps_type) == apps_type) && (!em->apps_charts) && (!em->cgroup_charts)) {

482 lmap->user_input = ND_EBPF_DEFAULT_MIN_PID;

483 + } else if (((em->apps_charts) || (em->cgroup_charts)) && (em->apps_level != NETDATA_APPS_NOT_SET)) {

484 + switch (em->apps_level) {

485 + case NETDATA_APPS_LEVEL_ALL: {

486 + define_size = lmap->user_input;

487 + break;

488 + }

489 + case NETDATA_APPS_LEVEL_PARENT: {

490 + define_size = ND_EBPF_DEFAULT_PID_SIZE / 2;

491 + break;

492 + }

493 + case NETDATA_APPS_LEVEL_REAL_PARENT:

494 + default: {

495 + define_size = ND_EBPF_DEFAULT_PID_SIZE / 3;

496 + }

497 + }

498 + }

499 +

500 + if (!define_size)

501 + return;

502 +

503 #ifdef LIBBPF_MAJOR_VERSION

481 - bpf_map__set_max_entries(map, lmap->user_input);

504 + bpf_map__set_max_entries(map, define_size);

505 #else

483 - bpf_map__resize(map, lmap->user_input);

506 + bpf_map__resize(map, define_size);

507 #endif

485 - }

508 }

509

510 /**

@@ -607,11 +629,18 @@ static void ebpf_update_maps(ebpf_module_t *em, struct bpf_object *obj)

629 */

630 void ebpf_update_controller(int fd, ebpf_module_t *em)

631 {

610 - uint32_t key = NETDATA_CONTROLLER_APPS_ENABLED;

611 - uint32_t value = (em->apps_charts & NETDATA_EBPF_APPS_FLAG_YES) | em->cgroup_charts;

612 - int ret = bpf_map_update_elem(fd, &key, &value, 0);

613 - if (ret)

614 - error("Add key(%u) for controller table failed.", key);

632 + uint32_t values[NETDATA_CONTROLLER_END] = {

633 + (em->apps_charts & NETDATA_EBPF_APPS_FLAG_YES) | em->cgroup_charts,

634 + em->apps_level

635 + };

636 + uint32_t key;

637 + uint32_t end = (em->apps_level != NETDATA_APPS_NOT_SET) ? NETDATA_CONTROLLER_END : NETDATA_CONTROLLER_APPS_LEVEL;

638 +

639 + for (key = NETDATA_CONTROLLER_APPS_ENABLED; key < end; key++) {

640 + int ret = bpf_map_update_elem(fd, &key, &values[key], 0);

641 + if (ret)

642 + error("Add key(%u) for controller table failed.", key);

643 + }

644 }

645

646 /**

@@ -805,6 +834,44 @@ static char *ebpf_convert_load_mode_to_string(netdata_ebpf_load_mode_t mode)

834 return EBPF_CFG_DEFAULT_PROGRAM;

835 }

836

837 +/**

838 + * Convert collect pid to string

839 + *

840 + * @param level value that will select the string

841 + *

842 + * @return It returns the string associated to level.

843 + */

844 +static char *ebpf_convert_collect_pid_to_string(netdata_apps_level_t level)

845 +{

846 + if (level == NETDATA_APPS_LEVEL_REAL_PARENT)

847 + return EBPF_CFG_PID_REAL_PARENT;

848 + else if (level == NETDATA_APPS_LEVEL_PARENT)

849 + return EBPF_CFG_PID_PARENT;

850 + else if (level == NETDATA_APPS_LEVEL_ALL)

851 + return EBPF_CFG_PID_ALL;

852 +

853 + return EBPF_CFG_PID_ALL;

854 +}

855 +

856 +/**

857 + * Convert string to apps level

858 + *

859 + * @param str the argument read from config files

860 + *

861 + * @return it returns the level associated to the string or default when it is a wrong value

862 + */

863 +netdata_apps_level_t ebpf_convert_string_to_apps_level(char *str)

864 +{

865 + if (!strcasecmp(str, EBPF_CFG_PID_REAL_PARENT))

866 + return NETDATA_APPS_LEVEL_REAL_PARENT;

867 + else if (!strcasecmp(str, EBPF_CFG_PID_PARENT))

868 + return NETDATA_APPS_LEVEL_PARENT;

869 + else if (!strcasecmp(str, EBPF_CFG_PID_ALL))

870 + return NETDATA_APPS_LEVEL_ALL;

871 +

872 + return NETDATA_APPS_NOT_SET;

873 +}

874 +

875 /**

876 * CO-RE type

877 *

@@ -984,6 +1051,10 @@ void ebpf_update_module_using_config(ebpf_module_t *modules)

1051 value = appconfig_get(modules->cfg, EBPF_GLOBAL_SECTION, EBPF_CFG_CORE_ATTACH, EBPF_CFG_ATTACH_TRAMPOLINE);

1052 netdata_ebpf_program_loaded_t fill_lm = ebpf_convert_core_type(value, modules->mode);

1053 ebpf_update_target_with_conf(modules, fill_lm);

1054 +

1055 + value = ebpf_convert_collect_pid_to_string(modules->apps_level);

1056 + value = appconfig_get(modules->cfg, EBPF_GLOBAL_SECTION, EBPF_CFG_COLLECT_PID, value);

1057 + modules->apps_level = ebpf_convert_string_to_apps_level(value);

1058 }

1059

1060 /**

@@ -1282,4 +1353,5 @@ void ebpf_select_host_prefix(char *output, size_t length, char *syscall, int kve

1353 char *prefix = (arch == 32) ? "__ia32" : "__x64";

1354 snprintfz(output, length, "%s_sys_%s", prefix, syscall);

1355 }

1285 -}

\ No newline at end of file

1356 +}

1357 +

libnetdata/ebpf/ebpf.h

+23 -2

@@ -26,6 +26,11 @@

26 #define EBPF_CFG_CORE_PROGRAM "CO-RE"

27 #define EBPF_CFG_LEGACY_PROGRAM "legacy"

29 +#define EBPF_CFG_COLLECT_PID "collect pid"

30 +#define EBPF_CFG_PID_REAL_PARENT "real parent"

31 +#define EBPF_CFG_PID_PARENT "parent"

32 +#define EBPF_CFG_PID_ALL "all"

33 +

34 #define EBPF_CFG_CORE_ATTACH "ebpf co-re tracing"

35 #define EBPF_CFG_ATTACH_TRAMPOLINE "trampoline"

36 #define EBPF_CFG_ATTACH_TRACEPOINT "tracepoint"

@@ -76,6 +81,7 @@ enum netdata_ebpf_kernel_versions {

81 NETDATA_EBPF_KERNEL_5_0 = 327680, // 327680 = 5 * 65536 + 0 * 256

82 NETDATA_EBPF_KERNEL_5_10 = 330240, // 330240 = 5 * 65536 + 10 * 256

83 NETDATA_EBPF_KERNEL_5_11 = 330496, // 330240 = 5 * 65536 + 11 * 256

84 + NETDATA_EBPF_KERNEL_5_14 = 331264, // 331264 = 5 * 65536 + 14 * 256

85 NETDATA_EBPF_KERNEL_5_15 = 331520, // 331520 = 5 * 65536 + 15 * 256

86 NETDATA_EBPF_KERNEL_5_16 = 331776 // 331776 = 5 * 65536 + 16 * 256

87 };

@@ -88,8 +94,9 @@ enum netdata_kernel_flag {

94 NETDATA_V5_4 = 1 << 4,

95 NETDATA_V5_10 = 1 << 5,

96 NETDATA_V5_11 = 1 << 6,

91 - NETDATA_V5_15 = 1 << 7,

92 - NETDATA_V5_16 = 1 << 8

97 + NETDATA_V5_14 = 1 << 7,

98 + NETDATA_V5_15 = 1 << 8,

99 + NETDATA_V5_16 = 1 << 9

100 };

101

102 enum netdata_kernel_idx {

@@ -100,6 +107,7 @@ enum netdata_kernel_idx {

107 NETDATA_IDX_V5_4 ,

108 NETDATA_IDX_V5_10,

109 NETDATA_IDX_V5_11,

110 + NETDATA_IDX_V5_14,

111 NETDATA_IDX_V5_15,

112 NETDATA_IDX_V5_16

113 };

@@ -111,6 +119,7 @@ enum netdata_kernel_idx {

119 #define NETDATA_IDX_STR_V5_4 "5.4"

120 #define NETDATA_IDX_STR_V5_10 "5.10"

121 #define NETDATA_IDX_STR_V5_11 "5.11"

122 +#define NETDATA_IDX_STR_V5_14 "5.14"

123 #define NETDATA_IDX_STR_V5_15 "5.15"

124 #define NETDATA_IDX_STR_V5_16 "5.16"

125

@@ -161,10 +170,21 @@ enum netdata_ebpf_map_type {

170

171 enum netdata_controller {

172 NETDATA_CONTROLLER_APPS_ENABLED,

173 + NETDATA_CONTROLLER_APPS_LEVEL,

174

175 NETDATA_CONTROLLER_END

176 };

177

178 +// Control how Netdata will monitor PIDs (apps and cgroups)

179 +typedef enum netdata_apps_level {

180 + NETDATA_APPS_LEVEL_REAL_PARENT,

181 + NETDATA_APPS_LEVEL_PARENT,

182 + NETDATA_APPS_LEVEL_ALL,

183 +

184 + // Present only in user ring

185 + NETDATA_APPS_NOT_SET

186 +} netdata_apps_level_t;

187 +

188 typedef struct ebpf_local_maps {

189 char *name;

190 uint32_t internal_input;

@@ -227,6 +247,7 @@ typedef struct ebpf_module {

247 int update_every;

248 int global_charts;

249 netdata_apps_integration_flags_t apps_charts;

250 + netdata_apps_level_t apps_level;

251 int cgroup_charts;

252 netdata_run_mode_t mode;

253 uint32_t thread_id;

packaging/current_libbpf.checksums

+1 -1

@@ -1 +1 @@

1 -8909385c347848b5994d9daa33be12e35ffc529ba0e01b5c944e0216bf78f79b v0.8.0_netdata.tar.gz

1 +1b4708f22af0e38ec29f01c9948ec2d436e8e06781ad6ad4a231ef62352a4736 v0.8.1_netdata.tar.gz

packaging/current_libbpf.version

+1 -1

@@ -1 +1 @@

1 -0.8.0_netdata

1 +0.8.1_netdata

packaging/ebpf-co-re.checksums

+1 -1

@@ -1 +1 @@

1 -9181063ec4a40f1b2ce5d7ac702eb9de233d127c6e21aac8a3d3f7c185502726 netdata-ebpf-co-re-glibc-v0.9.3.3.tar.xz

1 +26e6244242bb744adf2ff8640e267d54931d28fdd8150a967f9acedbd569a47b netdata-ebpf-co-re-glibc-v0.9.4.1.tar.xz

packaging/ebpf-co-re.version

+1 -1

@@ -1 +1 @@

1 -v0.9.3.3

1 +v0.9.4.1

packaging/ebpf.checksums

+3 -3

@@ -1,3 +1,3 @@

1 -cee483b29e1fd3125d635d03f9266d267eab1ba13e02c99afcf6a84bdcb729f4 ./netdata-kernel-collector-glibc-v0.9.3.tar.xz

2 -33aeae2cf7e9c0967c62f262bf6c6c44db49dc5dbb6d3a16e8bfde4433779069 ./netdata-kernel-collector-musl-v0.9.3.tar.xz

3 -9eba23184be7c9b29d22271e439e3fac517d32d500bd796c4e21f653b6f4d337 ./netdata-kernel-collector-static-v0.9.3.tar.xz

1 +49a4ab9eae3c519e6869ea414e63ea765d40ea41fb4c2cc8802a96a94a47ff74 ./netdata-kernel-collector-glibc-v0.9.4.tar.xz

2 +2284eb53ff61de823800585f993f13707d24ccd4d335b8bb39bbbd43b47cde75 ./netdata-kernel-collector-musl-v0.9.4.tar.xz

3 +46663fab8e5a279e8f2d4b76400f0e27552929ef6dee92a3ed81608250a1198b ./netdata-kernel-collector-static-v0.9.4.tar.xz

packaging/ebpf.version

+1 -1

@@ -1 +1 @@

1 -v0.9.3

1 +v0.9.4

packaging/libbpf.checksums

+1 -1

@@ -1 +1 @@

1 -8909385c347848b5994d9daa33be12e35ffc529ba0e01b5c944e0216bf78f79b v0.8.0_netdata.tar.gz

1 +1b4708f22af0e38ec29f01c9948ec2d436e8e06781ad6ad4a231ef62352a4736 v0.8.1_netdata.tar.gz

packaging/libbpf.version

+1 -1

@@ -1 +1 @@

1 -0.8.0_netdata

1 +0.8.1_netdata