diff options
Diffstat (limited to '')
| -rw-r--r-- | src/collectors/ebpf.plugin/ebpf_apps.h (renamed from collectors/ebpf.plugin/ebpf_apps.h) | 110 |
1 files changed, 49 insertions, 61 deletions
diff --git a/collectors/ebpf.plugin/ebpf_apps.h b/src/collectors/ebpf.plugin/ebpf_apps.h index 258091507..a2cbaf3b7 100644 --- a/collectors/ebpf.plugin/ebpf_apps.h +++ b/src/collectors/ebpf.plugin/ebpf_apps.h @@ -13,11 +13,14 @@ #define NETDATA_APP_FAMILY "app" #define NETDATA_APPS_FILE_GROUP "file_access" #define NETDATA_APPS_FILE_FDS "fds" -#define NETDATA_APPS_FILE_CGROUP_GROUP "file_access (eBPF)" -#define NETDATA_APPS_PROCESS_GROUP "process (eBPF)" +#define NETDATA_APPS_PROCESS_GROUP "process" #define NETDATA_APPS_NET_GROUP "net" #define NETDATA_APPS_IPC_SHM_GROUP "ipc shm" +#ifndef TASK_COMM_LEN +#define TASK_COMM_LEN 16 +#endif + #include "ebpf_process.h" #include "ebpf_dcstat.h" #include "ebpf_disk.h" @@ -39,6 +42,31 @@ #define EBPF_MAX_COMPARE_NAME 100 #define EBPF_MAX_NAME 100 +#define EBPF_CLEANUP_FACTOR 10 + +// ---------------------------------------------------------------------------- +// Structures used to read information from kernel ring +typedef struct ebpf_process_stat { + uint64_t ct; + uint32_t uid; + uint32_t gid; + char name[TASK_COMM_LEN]; + + uint32_t tgid; + uint32_t pid; + + //Counter + uint32_t exit_call; + uint32_t release_call; + uint32_t create_process; + uint32_t create_thread; + + //Counter + uint32_t task_err; + + uint8_t removeme; +} ebpf_process_stat_t; + // ---------------------------------------------------------------------------- // pid_stat // @@ -61,6 +89,8 @@ struct ebpf_target { netdata_publish_vfs_t vfs; netdata_fd_stat_t fd; netdata_publish_shm_t shm; + ebpf_process_stat_t process; + ebpf_socket_publish_apps_t socket; kernel_uint_t starttime; kernel_uint_t collected_starttime; @@ -84,7 +114,7 @@ extern struct ebpf_target *apps_groups_root_target; extern struct ebpf_target *users_root_target; extern struct ebpf_target *groups_root_target; -struct ebpf_pid_stat { +typedef struct ebpf_pid_stat { int32_t pid; char comm[EBPF_MAX_COMPARE_NAME + 1]; char *cmdline; @@ -105,6 +135,16 @@ struct ebpf_pid_stat { int sortlist; // higher numbers = top on the process tree // each process gets a unique number + netdata_publish_cachestat_t cachestat; + netdata_publish_dcstat_t dc; + netdata_fd_stat_t fd; + ebpf_process_stat_t process; + netdata_publish_shm_t shm; + netdata_publish_swap_t swap; + ebpf_socket_publish_apps_t socket; + netdata_publish_vfs_t vfs; + + int not_updated; struct ebpf_target *target; // app_groups.conf targets struct ebpf_target *user_target; // uid based targets @@ -113,6 +153,8 @@ struct ebpf_pid_stat { usec_t stat_collected_usec; usec_t last_stat_collected_usec; + netdata_publish_cachestat_t cache; + char *stat_filename; char *status_filename; char *io_filename; @@ -121,7 +163,7 @@ struct ebpf_pid_stat { struct ebpf_pid_stat *parent; struct ebpf_pid_stat *prev; struct ebpf_pid_stat *next; -}; +} ebpf_pid_stat_t; // ---------------------------------------------------------------------------- // target @@ -136,24 +178,6 @@ struct ebpf_pid_on_target { struct ebpf_pid_on_target *next; }; -// ---------------------------------------------------------------------------- -// Structures used to read information from kernel ring -typedef struct ebpf_process_stat { - uint64_t pid_tgid; // This cannot be removed, because it is used inside kernel ring. - uint32_t pid; - - //Counter - uint32_t exit_call; - uint32_t release_call; - uint32_t create_process; - uint32_t create_thread; - - //Counter - uint32_t task_err; - - uint8_t removeme; -} ebpf_process_stat_t; - /** * Internal function used to write debug messages. * @@ -186,8 +210,6 @@ void clean_apps_groups_target(struct ebpf_target *apps_groups_root_target); size_t zero_all_targets(struct ebpf_target *root); -int am_i_running_as_root(); - void cleanup_exited_pids(); int ebpf_read_hash_table(void *ep, int fd, uint32_t pid); @@ -197,16 +219,8 @@ int get_pid_comm(pid_t pid, size_t n, char *dest); void collect_data_for_all_processes(int tbl_pid_stats_fd, int maps_per_core); void ebpf_process_apps_accumulator(ebpf_process_stat_t *out, int maps_per_core); -extern ebpf_process_stat_t **global_process_stats; -extern netdata_publish_cachestat_t **cachestat_pid; -extern netdata_publish_dcstat_t **dcstat_pid; -extern netdata_publish_swap_t **swap_pid; -extern netdata_publish_vfs_t **vfs_pid; -extern netdata_fd_stat_t **fd_pid; -extern netdata_publish_shm_t **shm_pid; - // The default value is at least 32 times smaller than maximum number of PIDs allowed on system, -// this is only possible because we are using ARAL (https://github.com/netdata/netdata/tree/master/libnetdata/aral). +// this is only possible because we are using ARAL (https://github.com/netdata/netdata/tree/master/src/libnetdata/aral). #ifndef NETDATA_EBPF_ALLOC_MAX_PID # define NETDATA_EBPF_ALLOC_MAX_PID 1024 #endif @@ -214,51 +228,25 @@ extern netdata_publish_shm_t **shm_pid; // ARAL Sectiion extern void ebpf_aral_init(void); - -extern ebpf_process_stat_t *ebpf_process_stat_get(void); -extern void ebpf_process_stat_release(ebpf_process_stat_t *stat); +extern ebpf_pid_stat_t *ebpf_get_pid_entry(pid_t pid, pid_t tgid); extern ebpf_process_stat_t *process_stat_vector; -extern ARAL *ebpf_aral_socket_pid; -void ebpf_socket_aral_init(); -ebpf_socket_publish_apps_t *ebpf_socket_stat_get(void); - -extern ARAL *ebpf_aral_cachestat_pid; -void ebpf_cachestat_aral_init(); -netdata_publish_cachestat_t *ebpf_publish_cachestat_get(void); -void ebpf_cachestat_release(netdata_publish_cachestat_t *stat); - -extern ARAL *ebpf_aral_dcstat_pid; -void ebpf_dcstat_aral_init(); -netdata_publish_dcstat_t *ebpf_publish_dcstat_get(void); -void ebpf_dcstat_release(netdata_publish_dcstat_t *stat); - extern ARAL *ebpf_aral_vfs_pid; void ebpf_vfs_aral_init(); netdata_publish_vfs_t *ebpf_vfs_get(void); void ebpf_vfs_release(netdata_publish_vfs_t *stat); -extern ARAL *ebpf_aral_fd_pid; -void ebpf_fd_aral_init(); -netdata_fd_stat_t *ebpf_fd_stat_get(void); -void ebpf_fd_release(netdata_fd_stat_t *stat); - extern ARAL *ebpf_aral_shm_pid; void ebpf_shm_aral_init(); netdata_publish_shm_t *ebpf_shm_stat_get(void); void ebpf_shm_release(netdata_publish_shm_t *stat); +void ebpf_cleanup_exited_pids(int max); // ARAL Section end // Threads integrated with apps -extern ebpf_socket_publish_apps_t **socket_bandwidth_curr; // Threads integrated with apps #include "libnetdata/threads/threads.h" -// ARAL variables -extern ARAL *ebpf_aral_apps_pid_stat; -extern ARAL *ebpf_aral_process_stat; -#define NETDATA_EBPF_PROC_ARAL_NAME "ebpf_proc_stat" - #endif /* NETDATA_EBPF_APPS_H */ |