ebpf

Documentation

Index

• type BpfEvent
• type EbpfCollector
  • func NewEbpfCollector(parentCtx context.Context) *EbpfCollector
  • func (e *EbpfCollector) AttachGoTlsUprobesOnProcess(procfs string, pid uint32) []error
  • func (e *EbpfCollector) AttachSSlUprobes(pid uint32, executablePath string, version string) error
  • func (t *EbpfCollector) AttachSslUprobesOnProcess(procfs string, pid uint32) []error
  • func (e *EbpfCollector) AttachUprobesForEncrypted()
  • func (e *EbpfCollector) Deploy()
  • func (e *EbpfCollector) Done() chan struct{}
  • func (e *EbpfCollector) EbpfEvents() chan interface{}
  • func (e *EbpfCollector) ListenForEncryptedReqs(pid uint32)
• type PidLocks
  • func NewPidLocks() *PidLocks
  • func (p *PidLocks) Lock(pid uint32)
  • func (p *PidLocks) Release(pid uint32)

Types

type BpfEvent

type BpfEvent interface {
	Type() string
}

type EbpfCollector

type EbpfCollector struct {
	// contains filtered or unexported fields
}

func NewEbpfCollector

func NewEbpfCollector(parentCtx context.Context) *EbpfCollector

func (*EbpfCollector) AttachGoTlsUprobesOnProcess

func (e *EbpfCollector) AttachGoTlsUprobesOnProcess(procfs string, pid uint32) []error

func (*EbpfCollector) AttachSSlUprobes

func (e *EbpfCollector) AttachSSlUprobes(pid uint32, executablePath string, version string) error

func (*EbpfCollector) AttachSslUprobesOnProcess

func (t *EbpfCollector) AttachSslUprobesOnProcess(procfs string, pid uint32) []error

func (*EbpfCollector) AttachUprobesForEncrypted

func (e *EbpfCollector) AttachUprobesForEncrypted()

we check the size of the executable before reading it into memory because it can be very large otherwise we can get stuck to memory limit defined in k8s

func (*EbpfCollector) Deploy

func (e *EbpfCollector) Deploy()

func (*EbpfCollector) Done

func (e *EbpfCollector) Done() chan struct{}

func (*EbpfCollector) EbpfEvents

func (e *EbpfCollector) EbpfEvents() chan interface{}

func (*EbpfCollector) ListenForEncryptedReqs

func (e *EbpfCollector) ListenForEncryptedReqs(pid uint32)

in order to prevent the memory peak at the beginning we'll attach to processes one by one

type PidLocks

type PidLocks struct {
	// contains filtered or unexported fields
}

func NewPidLocks

func NewPidLocks() *PidLocks

func (*PidLocks) Lock

func (p *PidLocks) Lock(pid uint32)

func (*PidLocks) Release

func (p *PidLocks) Release(pid uint32)