mirror of
https://github.com/netdata/netdata.git
synced 2025-04-26 05:47:20 +00:00
thiagoftsm
GitHub
parent
9fe43430f2
commit
7f002c126d
11 changed files with 40 additions and 98 deletions
|
|
@ -75,43 +75,15 @@ pthread_mutex_t lock;
|
|||
pthread_mutex_t collect_data_mutex;
|
||||
pthread_cond_t collect_data_cond_var;
|
||||
|
||||
netdata_ebpf_events_t process_probes[] = {
|
||||
{ .type = 'r', .name = "vfs_write" },
|
||||
{ .type = 'r', .name = "vfs_writev" },
|
||||
{ .type = 'r', .name = "vfs_read" },
|
||||
{ .type = 'r', .name = "vfs_readv" },
|
||||
{ .type = 'r', .name = "do_sys_open" },
|
||||
{ .type = 'r', .name = "vfs_unlink" },
|
||||
{ .type = 'p', .name = "do_exit" },
|
||||
{ .type = 'p', .name = "release_task" },
|
||||
{ .type = 'r', .name = "_do_fork" },
|
||||
{ .type = 'r', .name = "__close_fd" },
|
||||
{ .type = 'p', .name = "try_to_wake_up" },
|
||||
{ .type = 'r', .name = "__x64_sys_clone" },
|
||||
{ .type = 0, .name = NULL }
|
||||
};
|
||||
|
||||
netdata_ebpf_events_t socket_probes[] = {
|
||||
{ .type = 'p', .name = "tcp_cleanup_rbuf" },
|
||||
{ .type = 'p', .name = "tcp_close" },
|
||||
{ .type = 'p', .name = "udp_recvmsg" },
|
||||
{ .type = 'r', .name = "udp_recvmsg" },
|
||||
{ .type = 'r', .name = "udp_sendmsg" },
|
||||
{ .type = 'p', .name = "do_exit" },
|
||||
{ .type = 'p', .name = "tcp_sendmsg" },
|
||||
{ .type = 'r', .name = "tcp_sendmsg" },
|
||||
{ .type = 0, .name = NULL }
|
||||
};
|
||||
|
||||
ebpf_module_t ebpf_modules[] = {
|
||||
{ .thread_name = "process", .config_name = "process", .enabled = 0, .start_routine = ebpf_process_thread,
|
||||
.update_time = 1, .global_charts = 1, .apps_charts = 1, .mode = MODE_ENTRY, .probes = process_probes,
|
||||
.update_time = 1, .global_charts = 1, .apps_charts = 1, .mode = MODE_ENTRY,
|
||||
.optional = 0 },
|
||||
{ .thread_name = "socket", .config_name = "socket", .enabled = 0, .start_routine = ebpf_socket_thread,
|
||||
.update_time = 1, .global_charts = 1, .apps_charts = 1, .mode = MODE_ENTRY, .probes = socket_probes,
|
||||
.update_time = 1, .global_charts = 1, .apps_charts = 1, .mode = MODE_ENTRY,
|
||||
.optional = 0 },
|
||||
{ .thread_name = NULL, .enabled = 0, .start_routine = NULL, .update_time = 1,
|
||||
.global_charts = 0, .apps_charts = 1, .mode = MODE_ENTRY, .probes = NULL,
|
||||
.global_charts = 0, .apps_charts = 1, .mode = MODE_ENTRY,
|
||||
.optional = 0 },
|
||||
};
|
||||
|
||||
|
|
@ -166,15 +138,6 @@ static void clean_ip_structure(ebpf_network_viewer_ip_list_t **clean)
|
|||
*clean = NULL;
|
||||
}
|
||||
|
||||
static void change_events()
|
||||
{
|
||||
if (ebpf_modules[0].mode == MODE_ENTRY)
|
||||
change_process_event();
|
||||
|
||||
if (ebpf_modules[1].mode == MODE_ENTRY)
|
||||
change_socket_event();
|
||||
}
|
||||
|
||||
/**
|
||||
* Clean Loaded Events
|
||||
*
|
||||
|
|
@ -1966,7 +1929,6 @@ int main(int argc, char **argv)
|
|||
{NULL , NULL, NULL, 0, NULL, NULL, NULL}
|
||||
};
|
||||
|
||||
change_events();
|
||||
//clean_loaded_events();
|
||||
|
||||
int i;
|
||||
|
|
|
|||
|
|
@ -109,8 +109,6 @@ extern int ebpf_nprocs;
|
|||
extern int running_on_kernel;
|
||||
extern char *ebpf_plugin_dir;
|
||||
extern char kernel_string[64];
|
||||
extern netdata_ebpf_events_t process_probes[];
|
||||
extern netdata_ebpf_events_t socket_probes[];
|
||||
|
||||
extern pthread_mutex_t collect_data_mutex;
|
||||
extern pthread_cond_t collect_data_cond_var;
|
||||
|
|
@ -193,8 +191,4 @@ extern uint32_t finalized_threads;
|
|||
|
||||
#define EBPF_MAX_SYNCHRONIZATION_TIME 300
|
||||
|
||||
// External functions
|
||||
extern void change_socket_event();
|
||||
extern void change_process_event();
|
||||
|
||||
#endif /* NETDATA_COLLECTOR_EBPF_H */
|
||||
|
|
|
|||
|
|
@ -1,2 +1 @@
|
|||
Ubuntu 4.18.0-13.
|
||||
Ubuntu 4.18.0-25.
|
||||
|
|
|
|||
|
|
@ -968,22 +968,10 @@ static void ebpf_process_allocate_global_vectors(size_t length)
|
|||
prev_apps_data = callocz((size_t)pid_max, sizeof(ebpf_process_publish_apps_t *));
|
||||
}
|
||||
|
||||
void change_process_event()
|
||||
{
|
||||
int i;
|
||||
if (running_on_kernel < NETDATA_KERNEL_V5_3)
|
||||
process_probes[EBPF_SYS_CLONE_IDX].name = NULL;
|
||||
|
||||
for (i = 0; process_probes[i].name; i++) {
|
||||
process_probes[i].type = 'p';
|
||||
}
|
||||
}
|
||||
|
||||
static void change_syscalls()
|
||||
{
|
||||
static char *lfork = { "do_fork" };
|
||||
process_id_names[7] = lfork;
|
||||
process_probes[8].name = lfork;
|
||||
}
|
||||
|
||||
/**
|
||||
|
|
|
|||
|
|
@ -1851,24 +1851,12 @@ static void ebpf_socket_allocate_global_vectors(size_t length)
|
|||
outbound_vectors.plot = callocz(network_viewer_opt.max_dim, sizeof(netdata_socket_plot_t));
|
||||
}
|
||||
|
||||
void change_socket_event()
|
||||
{
|
||||
socket_probes[0].type = 'p';
|
||||
socket_probes[4].type = 'p';
|
||||
socket_probes[5].type = 'p';
|
||||
socket_probes[7].name = NULL;
|
||||
}
|
||||
|
||||
/**
|
||||
* Set local function pointers, this function will never be compiled with static libraries
|
||||
*/
|
||||
static void set_local_pointers(ebpf_module_t *em)
|
||||
static void set_local_pointers()
|
||||
{
|
||||
map_fd = socket_data.map_fd;
|
||||
|
||||
if (em->mode == MODE_ENTRY) {
|
||||
change_socket_event();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
|
|
@ -1926,7 +1914,7 @@ void *ebpf_socket_thread(void *ptr)
|
|||
goto endsocket;
|
||||
}
|
||||
|
||||
set_local_pointers(em);
|
||||
set_local_pointers();
|
||||
probe_links = ebpf_load_program(ebpf_plugin_dir, em, kernel_string, &objects, socket_data.map_fd);
|
||||
if (!probe_links) {
|
||||
pthread_mutex_unlock(&lock);
|
||||
|
|
|
|||
|
|
@ -242,16 +242,18 @@ char *ebpf_kernel_suffix(int version, int isrh)
|
|||
{
|
||||
if (isrh) {
|
||||
if (version >= NETDATA_EBPF_KERNEL_4_11)
|
||||
return "4.18.0";
|
||||
return "4.18";
|
||||
else
|
||||
return "3.10.0";
|
||||
return "3.10";
|
||||
} else {
|
||||
if (version >= NETDATA_EBPF_KERNEL_4_17)
|
||||
return "5.4.20";
|
||||
if (version >= NETDATA_EBPF_KERNEL_5_10)
|
||||
return "5.10";
|
||||
else if (version >= NETDATA_EBPF_KERNEL_4_17)
|
||||
return "5.4";
|
||||
else if (version >= NETDATA_EBPF_KERNEL_4_15)
|
||||
return "4.16.18";
|
||||
return "4.16";
|
||||
else if (version >= NETDATA_EBPF_KERNEL_4_11)
|
||||
return "4.14.171";
|
||||
return "4.14";
|
||||
}
|
||||
|
||||
return NULL;
|
||||
|
|
@ -294,6 +296,7 @@ struct bpf_link **ebpf_load_program(char *plugins_dir, ebpf_module_t *em, char *
|
|||
|
||||
snprintf(lpath, 4096, "%s/%s", plugins_dir, lname);
|
||||
if (bpf_prog_load(lpath, BPF_PROG_TYPE_KPROBE, obj, &prog_fd)) {
|
||||
em->enabled = CONFIG_BOOLEAN_NO;
|
||||
info("Cannot load program: %s", lpath);
|
||||
return NULL;
|
||||
} else {
|
||||
|
|
|
|||
|
|
@ -31,6 +31,13 @@
|
|||
*/
|
||||
#define NETDATA_RH_8 2048
|
||||
|
||||
/**
|
||||
* Kernel 5.10
|
||||
*
|
||||
* 330240 = 5*65536 + 10*256
|
||||
*/
|
||||
#define NETDATA_EBPF_KERNEL_5_10 330240
|
||||
|
||||
/**
|
||||
* Kernel 4.17
|
||||
*
|
||||
|
|
@ -55,11 +62,6 @@
|
|||
#define VERSION_STRING_LEN 256
|
||||
#define EBPF_KERNEL_REJECT_LIST_FILE "ebpf_kernel_reject_list.txt"
|
||||
|
||||
typedef struct netdata_ebpf_events {
|
||||
char type;
|
||||
char *name;
|
||||
} netdata_ebpf_events_t;
|
||||
|
||||
typedef struct ebpf_data {
|
||||
int *map_fd;
|
||||
|
||||
|
|
@ -83,14 +85,12 @@ typedef struct ebpf_module {
|
|||
int global_charts;
|
||||
int apps_charts;
|
||||
netdata_run_mode_t mode;
|
||||
netdata_ebpf_events_t *probes;
|
||||
uint32_t thread_id;
|
||||
int optional;
|
||||
} ebpf_module_t;
|
||||
|
||||
#define NETDATA_MAX_PROBES 64
|
||||
|
||||
extern int clean_kprobe_events(FILE *out, int pid, netdata_ebpf_events_t *ptr);
|
||||
extern int get_kernel_version(char *out, int size);
|
||||
extern int get_redhat_release();
|
||||
extern int has_condition_to_run(int version);
|
||||
|
|
|
|||
|
|
@ -1608,6 +1608,14 @@ remove_old_ebpf() {
|
|||
echo >&2 "Renaming eBPF configuration file."
|
||||
mv "${NETDATA_PREFIX}/etc/netdata/ebpf_process.conf" "${NETDATA_PREFIX}/etc/netdata/ebpf.conf"
|
||||
fi
|
||||
|
||||
# Added to remove eBPF programs with name pattern: NAME_VERSION.SUBVERSION.PATCH
|
||||
if [ -f "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/pnetdata_ebpf_process.3.10.0.o" ]; then
|
||||
echo >&2 "Removing old eBPF programs"
|
||||
rm -f "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/rnetdata_ebpf"*.?.*.*.o
|
||||
rm -f "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/pnetdata_ebpf"*.?.*.*.o
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
install_ebpf() {
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
723fecc3a74065f724d4af2780674f5aeb7f0b968899abc9e171fca1623ecd2a netdata-kernel-collector-glibc-v0.5.2.tar.xz
|
||||
f2110b1c149017c4a4f486e30d701731a5d12050345f9038c63c6dcc81d8e4d4 netdata-kernel-collector-musl-v0.5.2.tar.xz
|
||||
6587a4aedf4e0f17d725c4b8cee1f9b9fdbca41f9cd4fe85e4abbfdc03f27465 netdata-kernel-collector-static-v0.5.2.tar.xz
|
||||
bcc2e38754f277e84aefdb2760d7de2b32611576718234e1cecdb70a87e93497 netdata-kernel-collector-glibc-v0.5.4.tar.xz
|
||||
912675155f438c9fdccc1e91c1423fa4bb914a9c7e2d7b843f551e053f4374eb netdata-kernel-collector-musl-v0.5.4.tar.xz
|
||||
dd0f63895305c38669b512f9e95a75057340f04ea999c3ea3540cb18a893dc52 netdata-kernel-collector-static-v0.5.4.tar.xz
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
v0.5.2
|
||||
v0.5.4
|
||||
|
|
|
|||
|
|
@ -1105,13 +1105,13 @@ netdataDashboard.context = {
|
|||
},
|
||||
|
||||
'apps.file_open': {
|
||||
info: 'Calls to the internal function <code>do_sys_open</code>, which is the common function called from' +
|
||||
info: 'Calls to the internal function <code>do_sys_open</code> ( For kernels newer than <code>5.5.19</code> we add a kprobe to <code>do_sys_openat2</code>. ), which is the common function called from' +
|
||||
' <a href="https://www.man7.org/linux/man-pages/man2/open.2.html" target="_blank">open(2)</a> ' +
|
||||
' and <a href="https://www.man7.org/linux/man-pages/man2/openat.2.html" target="_blank">openat(2)</a>. '
|
||||
},
|
||||
|
||||
'apps.file_open_error': {
|
||||
info: 'Failed calls to the internal function <code>do_sys_open</code>.'
|
||||
info: 'Failed calls to the internal function <code>do_sys_open</code> ( For kernels newer than <code>5.5.19</code> we add a kprobe to <code>do_sys_openat2</code>. ).'
|
||||
},
|
||||
|
||||
'apps.file_closed': {
|
||||
|
|
@ -1152,11 +1152,11 @@ netdataDashboard.context = {
|
|||
},
|
||||
|
||||
'apps.process_create': {
|
||||
info: 'Calls to the function <a href="https://www.ece.uic.edu/~yshi1/linux/lkse/node4.html#SECTION00421000000000000000" target="_blank">do_fork</a> to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the process by counting the number of calls to <a href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that do not have the flag <code>CLONE_THREAD</code> set.'
|
||||
info: 'Calls to either <a href="https://www.ece.uic.edu/~yshi1/linux/lkse/node4.html#SECTION00421000000000000000" target="_blank">do_fork</a>, or <code>kernel_clone</code> if you are running kernel newer than 5.9.16, to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the process by counting the number of calls to <a href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that do not have the flag <code>CLONE_THREAD</code> set.'
|
||||
},
|
||||
|
||||
'apps.thread_create': {
|
||||
info: 'Calls to the function <a href="https://www.ece.uic.edu/~yshi1/linux/lkse/node4.html#SECTION00421000000000000000" target="_blank">do_fork</a> to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the threads by counting the number of calls to <a href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that have the flag <code>CLONE_THREAD</code> set.'
|
||||
info: 'Calls to either <a href="https://www.ece.uic.edu/~yshi1/linux/lkse/node4.html#SECTION00421000000000000000" target="_blank">do_fork</a>, or <code>kernel_clone</code> if you are running kernel newer than 5.9.16, to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the threads by counting the number of calls to <a href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that have the flag <code>CLONE_THREAD</code> set.'
|
||||
},
|
||||
|
||||
'apps.task_close': {
|
||||
|
|
@ -3297,7 +3297,7 @@ netdataDashboard.context = {
|
|||
|
||||
'ebpf.file_descriptor': {
|
||||
title : 'File access',
|
||||
info: 'Calls for internal functions on Linux kernel. The open dimension is attached to the kernel internal function <code>do_sys_open</code>, which is the common function called from'+
|
||||
info: 'Calls for internal functions on Linux kernel. The open dimension is attached to the kernel internal function <code>do_sys_open</code> ( For kernels newer than <code>5.5.19</code> we add a kprobe to <code>do_sys_openat2</code>. ), which is the common function called from'+
|
||||
' <a href="https://www.man7.org/linux/man-pages/man2/open.2.html" target="_blank">open(2)</a> ' +
|
||||
' and <a href="https://www.man7.org/linux/man-pages/man2/openat.2.html" target="_blank">openat(2)</a>. ' +
|
||||
' The close dimension is attached to the function <code>__close_fd</code>, which is called from system call' +
|
||||
|
|
@ -3306,7 +3306,7 @@ netdataDashboard.context = {
|
|||
|
||||
'ebpf.file_error': {
|
||||
title : 'File access error',
|
||||
info: 'Failed calls to the kernel internal function <code>do_sys_open</code>, which is the common function called from'+
|
||||
info: 'Failed calls to the kernel internal function <code>do_sys_open</code> ( For kernels newer than <code>5.5.19</code> we add a kprobe to <code>do_sys_openat2</code>. ), which is the common function called from'+
|
||||
' <a href="https://www.man7.org/linux/man-pages/man2/open.2.html" target="_blank">open(2)</a> ' +
|
||||
' and <a href="https://www.man7.org/linux/man-pages/man2/openat.2.html" target="_blank">openat(2)</a>. ' +
|
||||
' The close dimension is attached to the function <code>__close_fd</code>, which is called from system call' +
|
||||
|
|
@ -3335,7 +3335,7 @@ netdataDashboard.context = {
|
|||
|
||||
'ebpf.process_thread': {
|
||||
title : 'Task creation',
|
||||
info: 'Number of times that the function <a href="https://www.ece.uic.edu/~yshi1/linux/lkse/node4.html#SECTION00421000000000000000" target="_blank">do_fork</a> is called to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the threads by couting the number of calls for <a href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that has the flag <code>CLONE_THREAD</code> set.'
|
||||
info: 'Number of times that either <a href="https://www.ece.uic.edu/~yshi1/linux/lkse/node4.html#SECTION00421000000000000000" target="_blank">do_fork</a>, or <code>kernel_clone</code> if you are running kernel newer than 5.9.16, is called to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the threads by couting the number of calls for <a href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that has the flag <code>CLONE_THREAD</code> set.'
|
||||
},
|
||||
|
||||
'ebpf.exit': {
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue