host

Documentation

Overview

Package host implements types and methods specific to interacting with eBPF maps.

Index

• type FileID
  • func CalculateID(fileName string) (FileID, error)
  • func CalculateKernelFileID(id libpf.FileID) FileID
  • func FileIDFromBytes(b []byte) (FileID, error)
  • func (fid FileID) StringNoQuotes() string
• type Frame
• type Trace
• type TraceHash

Types

type FileID

type FileID uint64

FileID is used for unique identifiers for files, and is required to be 64-bits due to the constraints imposed by the eBPF maps, unlike the larger FileID used outside the host agent.

func CalculateID

func CalculateID(fileName string) (FileID, error)

CalculateID calculates a 64-bit executable ID of the contents of a file.

func CalculateKernelFileID

func CalculateKernelFileID(id libpf.FileID) FileID

CalculateKernelFileID calculates an ID for a kernel image or module given its libpf.FileID.

func FileIDFromBytes

func FileIDFromBytes(b []byte) (FileID, error)

FileIDFromBytes parses a byte slice into the internal data representation for a file ID.

func (FileID) StringNoQuotes

func (fid FileID) StringNoQuotes() string

type Frame

type Frame struct {
	File   FileID
	Lineno libpf.AddressOrLineno
	Type   libpf.FrameType
}

type Trace

type Trace struct {
	Comm   string
	Frames []Frame
	Hash   TraceHash
	KTime  libpf.KTime
	PID    libpf.PID
}

type TraceHash

type TraceHash uint64

TraceHash is used for unique identifiers for traces, and is required to be 64-bits due to the constraints imposed by the eBPF maps, unlike the larger TraceHash used outside the host agent.