| 1 | <!--startmeta |
| 2 | custom_edit_url: "https://github.com/netdata/netdata/edit/master/src/collectors/ebpf.plugin/integrations/ebpf_socket.md" |
| 3 | meta_yaml: "https://github.com/netdata/netdata/edit/master/src/collectors/ebpf.plugin/metadata.yaml" |
| 4 | sidebar_label: "eBPF Socket" |
| 5 | learn_status: "Published" |
| 6 | learn_rel_path: "Collecting Metrics/Collectors/Networking" |
| 7 | keywords: ['TCP', 'UDP', 'bandwidth', 'server', 'connection', 'socket'] |
| 8 | message: "DO NOT EDIT THIS FILE DIRECTLY, IT IS GENERATED BY THE COLLECTOR'S metadata.yaml FILE" |
| 9 | endmeta--> |
| 10 | |
| 11 | # eBPF Socket |
| 12 | |
| 13 | |
| 14 | <img src="https://netdata.cloud/img/ebpf.jpg" width="150"/> |
| 15 | |
| 16 | |
| 17 | Plugin: ebpf.plugin |
| 18 | Module: socket |
| 19 | |
| 20 | <img src="https://img.shields.io/badge/maintained%20by-Netdata-%2300ab44" /> |
| 21 | |
| 22 | ## Overview |
| 23 | |
| 24 | Monitor bandwidth consumption per application for protocols TCP and UDP. |
| 25 | |
| 26 | Attach tracing (kprobe, trampoline) to internal kernel functions according options used to compile kernel. |
| 27 | |
| 28 | This collector is only supported on the following platforms: |
| 29 | |
| 30 | - Linux |
| 31 | |
| 32 | This collector supports collecting metrics from multiple instances of this integration, including remote instances. |
| 33 | |
| 34 | The plugin needs setuid because it loads data inside kernel. Netada sets necessary permission during installation time. |
| 35 | |
| 36 | eBPF Socket can be monitored further using the following other integrations: |
| 37 | |
| 38 | - [Applications](/src/collectors/apps.plugin/integrations/applications.md) |
| 39 | - [Containers](/src/collectors/cgroups.plugin/integrations/containers.md) |
| 40 | |
| 41 | ### Default Behavior |
| 42 | |
| 43 | #### Auto-Detection |
| 44 | |
| 45 | The plugin checks kernel compilation flags (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) and presence of BTF files to decide which eBPF program will be attached. |
| 46 | |
| 47 | #### Limits |
| 48 | |
| 49 | The default configuration for this integration does not impose any limits on data collection. |
| 50 | |
| 51 | #### Performance Impact |
| 52 | |
| 53 | This thread will add overhead every time that an internal kernel function monitored by this thread is called. The estimated additional period of time is between 90-200ns per call on kernels that do not have BTF technology. |
| 54 | |
| 55 | ## Setup |
| 56 | |
| 57 | |
| 58 | ### Prerequisites |
| 59 | |
| 60 | #### Compile kernel |
| 61 | |
| 62 | Check if your kernel was compiled with necessary options (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) in `/proc/config.gz` or inside /boot/config file. Some cited names can be different accoring preferences of Linux distributions. |
| 63 | When you do not have options set, it is necessary to get the kernel source code from https://kernel.org or a kernel package from your distribution, this last is preferred. The kernel compilation has a well definedd pattern, but distributions can deliver their configuration files |
| 64 | with different names. |
| 65 | |
| 66 | Now follow steps: |
| 67 | 1. Copy the configuration file to /usr/src/linux/.config. |
| 68 | 2. Select the necessary options: make oldconfig |
| 69 | 3. Compile your kernel image: make bzImage |
| 70 | 4. Compile your modules: make modules |
| 71 | 5. Copy your new kernel image for boot loader directory |
| 72 | 6. Install the new modules: make modules_install |
| 73 | 7. Generate an initial ramdisk image (`initrd`) if it is necessary. |
| 74 | 8. Update your boot loader |
| 75 | |
| 76 | |
| 77 | |
| 78 | ### Configuration |
| 79 | |
| 80 | #### Options |
| 81 | |
| 82 | All options are defined inside section `[global]`. Options inside `network connections` are ignored for while. |
| 83 | |
| 84 | |
| 85 | <details open><summary>Config options</summary> |
| 86 | |
| 87 | |
| 88 | |
| 89 | | Option | Description | Default | Required | |
| 90 | |:-----|:------------|:--------|:---------:| |
| 91 | | update every | Data collection frequency. | 10 | no | |
| 92 | | ebpf load mode | Define whether plugin will monitor the call (`entry`) for the functions or it will also monitor the return (`return`). | entry | no | |
| 93 | | apps | Enable or disable integration with apps.plugin | no | no | |
| 94 | | cgroups | Enable or disable integration with cgroup.plugin | no | no | |
| 95 | | bandwidth table size | Number of elements stored inside hash tables used to monitor calls per PID. | 16384 | no | |
| 96 | | ipv4 connection table size | Number of elements stored inside hash tables used to monitor calls per IPV4 connections. | 16384 | no | |
| 97 | | ipv6 connection table size | Number of elements stored inside hash tables used to monitor calls per IPV6 connections. | 16384 | no | |
| 98 | | udp connection table size | Number of temporary elements stored inside hash tables used to monitor UDP connections. | 4096 | no | |
| 99 | | ebpf type format | Define the file type to load an eBPF program. Three options are available: `legacy` (Attach only `kprobe`), `co-re` (Plugin tries to use `trampoline` when available), and `auto` (plugin check OS configuration before to load). | auto | no | |
| 100 | | ebpf co-re tracing | Select the attach method used by plugin when `co-re` is defined in previous option. Two options are available: `trampoline` (Option with lowest overhead), and `probe` (the same of legacy code). | trampoline | no | |
| 101 | | maps per core | Define how plugin will load their hash maps. When enabled (`yes`) plugin will load one hash table per core, instead to have centralized information. | yes | no | |
| 102 | | lifetime | Set default lifetime for thread when enabled by cloud. | 300 | no | |
| 103 | |
| 104 | |
| 105 | </details> |
| 106 | |
| 107 | |
| 108 | |
| 109 | #### via File |
| 110 | |
| 111 | The configuration file name for this integration is `ebpf.d/network.conf`. |
| 112 | |
| 113 | The file format is a modified INI syntax. The general structure is: |
| 114 | |
| 115 | ```ini |
| 116 | [section1] |
| 117 | option1 = some value |
| 118 | option2 = some other value |
| 119 | |
| 120 | [section2] |
| 121 | option3 = some third value |
| 122 | ``` |
| 123 | You can edit the configuration file using the [`edit-config`](https://github.com/netdata/netdata/blob/master/docs/netdata-agent/configuration/README.md#edit-configuration-files) script from the |
| 124 | Netdata [config directory](https://github.com/netdata/netdata/blob/master/docs/netdata-agent/configuration/README.md#locate-your-config-directory). |
| 125 | |
| 126 | ```bash |
| 127 | cd /etc/netdata 2>/dev/null || cd /opt/netdata/etc/netdata |
| 128 | sudo ./edit-config ebpf.d/network.conf |
| 129 | ``` |
| 130 | |
| 131 | ##### Examples |
| 132 | There are no configuration examples. |
| 133 | |
| 134 | |
| 135 | |
| 136 | ## Alerts |
| 137 | |
| 138 | There are no alerts configured by default for this integration. |
| 139 | |
| 140 | |
| 141 | ## Metrics |
| 142 | |
| 143 | Metrics grouped by *scope*. |
| 144 | |
| 145 | The scope defines the instance that the metric belongs to. An instance is uniquely identified by a set of labels. |
| 146 | |
| 147 | |
| 148 | |
| 149 | ### Per eBPF Socket instance |
| 150 | |
| 151 | These metrics show total number of calls to functions inside kernel. |
| 152 | |
| 153 | This scope has no labels. |
| 154 | |
| 155 | Metrics: |
| 156 | |
| 157 | | Metric | Dimensions | Unit | |
| 158 | |:------|:----------|:----| |
| 159 | | ip.inbound_conn | connected_tcp, connected_udp | connections/s | |
| 160 | | ip.tcp_outbound_conn | received | connections/s | |
| 161 | | ip.tcp_functions | received, send, closed | calls/s | |
| 162 | | ip.total_tcp_bandwidth | received, send | kilobits/s | |
| 163 | | ip.tcp_error | received, send | calls/s | |
| 164 | | ip.tcp_retransmit | retransmitted | calls/s | |
| 165 | | ip.udp_functions | received, send | calls/s | |
| 166 | | ip.total_udp_bandwidth | received, send | kilobits/s | |
| 167 | | ip.udp_error | received, send | calls/s | |
| 168 | |
| 169 | ### Per apps |
| 170 | |
| 171 | These metrics show grouped information per apps group. |
| 172 | |
| 173 | Labels: |
| 174 | |
| 175 | | Label | Description | |
| 176 | |:-----------|:----------------| |
| 177 | | app_group | The name of the group defined in the configuration. | |
| 178 | |
| 179 | Metrics: |
| 180 | |
| 181 | | Metric | Dimensions | Unit | |
| 182 | |:------|:----------|:----| |
| 183 | | app.ebpf_call_tcp_v4_connection | connections | connections/s | |
| 184 | | app.ebpf_call_tcp_v6_connection | connections | connections/s | |
| 185 | | app.ebpf_sock_total_bandwidth | received, sent | kilobits/s | |
| 186 | | app.ebpf_call_tcp_sendmsg | calls | calls/s | |
| 187 | | app.ebpf_call_tcp_cleanup_rbuf | calls | calls/s | |
| 188 | | app.ebpf_call_tcp_retransmit | calls | calls/s | |
| 189 | | app.ebpf_call_udp_sendmsg | calls | calls/s | |
| 190 | | app.ebpf_call_udp_recvmsg | calls | calls/s | |
| 191 | |
| 192 | ### Per cgroup |
| 193 | |
| 194 | |
| 195 | |
| 196 | This scope has no labels. |
| 197 | |
| 198 | Metrics: |
| 199 | |
| 200 | | Metric | Dimensions | Unit | |
| 201 | |:------|:----------|:----| |
| 202 | | cgroup.net_conn_ipv4 | connections | connections/s | |
| 203 | | cgroup.net_conn_ipv6 | connections | connections/s | |
| 204 | | cgroup.net_total_bandwidth | received, sent | kilobits/s | |
| 205 | | cgroup.net_tcp_recv | calls | calls/s | |
| 206 | | cgroup.net_tcp_send | calls | calls/s | |
| 207 | | cgroup.net_retransmit | calls | calls/s | |
| 208 | | cgroup.net_udp_send | calls | calls/s | |
| 209 | | cgroup.net_udp_recv | calls | calls/s | |
| 210 | | services.net_conn_ipv4 | connections | connections/s | |
| 211 | | services.net_conn_ipv6 | connections | connections/s | |
| 212 | | services.net_total_bandwidth | received, sent | kilobits/s | |
| 213 | | services.net_tcp_recv | calls | calls/s | |
| 214 | | services.net_tcp_send | calls | calls/s | |
| 215 | | services.net_tcp_retransmit | calls | calls/s | |
| 216 | | services.net_udp_send | calls | calls/s | |
| 217 | | services.net_udp_recv | calls | calls/s | |
| 218 | |
| 219 |