1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
|
// SPDX-License-Identifier: GPL-3.0-or-later
#ifndef NETDATA_COLLECTOR_EBPF_H
#define NETDATA_COLLECTOR_EBPF_H 1
#ifndef __FreeBSD__
#include <linux/perf_event.h>
#endif
#include <stdint.h>
#include <errno.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <dlfcn.h>
#include <fcntl.h>
#include <ctype.h>
#include <dirent.h>
// From libnetdata.h
#include "libnetdata/threads/threads.h"
#include "libnetdata/locks/locks.h"
#include "libnetdata/avl/avl.h"
#include "libnetdata/clocks/clocks.h"
#include "libnetdata/config/appconfig.h"
#include "libnetdata/ebpf/ebpf.h"
#include "libnetdata/procfile/procfile.h"
#include "daemon/main.h"
#include "ebpf_apps.h"
#define NETDATA_EBPF_OLD_CONFIG_FILE "ebpf.conf"
#define NETDATA_EBPF_CONFIG_FILE "ebpf.d.conf"
typedef struct netdata_syscall_stat {
unsigned long bytes; // total number of bytes
uint64_t call; // total number of calls
uint64_t ecall; // number of calls that returned error
struct netdata_syscall_stat *next; // Link list
} netdata_syscall_stat_t;
typedef uint64_t netdata_idx_t;
typedef struct netdata_publish_syscall {
char *dimension;
char *name;
char *algorithm;
unsigned long nbyte;
unsigned long pbyte;
uint64_t ncall;
uint64_t pcall;
uint64_t nerr;
uint64_t perr;
struct netdata_publish_syscall *next;
} netdata_publish_syscall_t;
typedef struct netdata_publish_vfs_common {
long write;
long read;
long running;
long zombie;
} netdata_publish_vfs_common_t;
typedef struct netdata_error_report {
char comm[16];
__u32 pid;
int type;
int err;
} netdata_error_report_t;
extern ebpf_module_t ebpf_modules[];
enum ebpf_module_indexes {
EBPF_MODULE_PROCESS_IDX,
EBPF_MODULE_SOCKET_IDX,
EBPF_MODULE_CACHESTAT_IDX,
EBPF_MODULE_SYNC_IDX,
EBPF_MODULE_DCSTAT_IDX
};
// Copied from musl header
#ifndef offsetof
#if __GNUC__ > 3
#define offsetof(type, member) __builtin_offsetof(type, member)
#else
#define offsetof(type, member) ((size_t)((char *)&(((type *)0)->member) - (char *)0))
#endif
#endif
// Chart definitions
#define NETDATA_EBPF_FAMILY "ebpf"
#define NETDATA_FILESYSTEM_FAMILY "filesystem"
#define NETDATA_EBPF_CHART_TYPE_LINE "line"
#define NETDATA_EBPF_CHART_TYPE_STACKED "stacked"
#define NETDATA_EBPF_MEMORY_GROUP "mem"
// Log file
#define NETDATA_DEVELOPER_LOG_FILE "developer.log"
// Maximum number of processors monitored on perf events
#define NETDATA_MAX_PROCESSOR 512
// Kernel versions calculated with the formula:
// R = MAJOR*65536 + MINOR*256 + PATCH
#define NETDATA_KERNEL_V5_3 328448
#define NETDATA_KERNEL_V4_15 265984
#define EBPF_SYS_CLONE_IDX 11
#define EBPF_MAX_MAPS 32
enum ebpf_algorithms_list {
NETDATA_EBPF_ABSOLUTE_IDX,
NETDATA_EBPF_INCREMENTAL_IDX
};
// Threads
extern void *ebpf_process_thread(void *ptr);
extern void *ebpf_socket_thread(void *ptr);
// Common variables
extern pthread_mutex_t lock;
extern int close_ebpf_plugin;
extern int ebpf_nprocs;
extern int running_on_kernel;
extern char *ebpf_plugin_dir;
extern char kernel_string[64];
extern pthread_mutex_t collect_data_mutex;
extern pthread_cond_t collect_data_cond_var;
// Common functions
extern void ebpf_global_labels(netdata_syscall_stat_t *is,
netdata_publish_syscall_t *pio,
char **dim,
char **name,
int *algorithm,
int end);
extern void ebpf_write_chart_cmd(char *type,
char *id,
char *title,
char *units,
char *family,
char *charttype,
char *context,
int order);
extern void ebpf_write_global_dimension(char *name, char *id, char *algorithm);
extern void ebpf_create_global_dimension(void *ptr, int end);
extern void ebpf_create_chart(char *type,
char *id,
char *title,
char *units,
char *family,
char *context,
char *charttype,
int order,
void (*ncd)(void *, int),
void *move,
int end);
extern void write_begin_chart(char *family, char *name);
extern void write_chart_dimension(char *dim, long long value);
extern void write_count_chart(char *name, char *family, netdata_publish_syscall_t *move, uint32_t end);
extern void write_err_chart(char *name, char *family, netdata_publish_syscall_t *move, int end);
extern void write_io_chart(char *chart, char *family, char *dwrite, long long vwrite,
char *dread, long long vread);
extern void fill_ebpf_data(ebpf_data_t *ef);
extern void ebpf_create_charts_on_apps(char *name,
char *title,
char *units,
char *family,
char *charttype,
int order,
char *algorithm,
struct target *root);
extern void write_end_chart();
extern void ebpf_cleanup_publish_syscall(netdata_publish_syscall_t *nps);
#define EBPF_PROGRAMS_SECTION "ebpf programs"
#define EBPF_COMMON_DIMENSION_PERCENTAGE "%"
#define EBPF_COMMON_DIMENSION_CALL "calls/s"
#define EBPF_COMMON_DIMENSION_BITS "kilobits/s"
#define EBPF_COMMON_DIMENSION_BYTES "bytes/s"
#define EBPF_COMMON_DIMENSION_DIFFERENCE "difference"
#define EBPF_COMMON_DIMENSION_PACKETS "packets"
#define EBPF_COMMON_DIMENSION_FILES "files"
// Common variables
extern int debug_enabled;
extern struct pid_stat *root_of_pids;
extern char *ebpf_algorithms[];
extern struct config collector_config;
extern struct pid_stat *root_of_pids;
extern ebpf_process_stat_t *global_process_stat;
extern size_t all_pids_count;
extern int update_every;
extern uint32_t finalized_threads;
// Socket functions and variables
// Common functions
extern void ebpf_process_create_apps_charts(struct ebpf_module *em, void *ptr);
extern void ebpf_socket_create_apps_charts(struct ebpf_module *em, void *ptr);
extern void ebpf_cachestat_create_apps_charts(struct ebpf_module *em, void *root);
extern void ebpf_one_dimension_write_charts(char *family, char *chart, char *dim, long long v1);
extern collected_number get_value_from_structure(char *basis, size_t offset);
extern void ebpf_update_pid_table(ebpf_local_maps_t *pid, ebpf_module_t *em);
#define EBPF_MAX_SYNCHRONIZATION_TIME 300
#endif /* NETDATA_COLLECTOR_EBPF_H */
|
