ebpf

Documentation

Index

• type ProcessFinder
  • func (pf *ProcessFinder) Close() error
  • func (pf *ProcessFinder) Start(ctx context.Context) (<-chan *ProcessTracer, error)
• type ProcessTracer
  • func (pt *ProcessTracer) Run(ctx context.Context, out chan<- []request.Span)
• type Tracer

Types

type ProcessFinder

type ProcessFinder struct {
	Cfg     *ebpfcommon.TracerConfig
	Metrics imetrics.Reporter
	CtxInfo *global.ContextInfo
	// contains filtered or unexported fields
}

ProcessFinder continuously listens in background for a process matching the search criteria as specified to the user.

func (*ProcessFinder) Close

func (pf *ProcessFinder) Close() error

func (*ProcessFinder) Start

func (pf *ProcessFinder) Start(ctx context.Context) (<-chan *ProcessTracer, error)

type ProcessTracer

type ProcessTracer struct {
	ELFInfo *exec.FileInfo
	// contains filtered or unexported fields
}

ProcessTracer instruments an executable with eBPF and provides the eBPF readers that will forward the traces to later stages in the pipeline TODO: split in two, the instrumenter and the reader

func (*ProcessTracer) Run

func (pt *ProcessTracer) Run(ctx context.Context, out chan<- []request.Span)

type Tracer

type Tracer interface {
	// Load the bpf object that is generated by the bpf2go compiler
	Load() (*ebpf.CollectionSpec, error)
	// Constants returns a map of constants to be overriden into the eBPF program.
	// The key is the constant name and the value is the value to overwrite.
	Constants(*exec.FileInfo, *goexec.Offsets) map[string]any
	// BpfObjects that are created by the bpf2go compiler
	BpfObjects() any
	// GoProbes returns a map with the name of Go functions that need to be inspected
	// in the executable, as well as the eBPF programs that optionally need to be
	// inserted as the Go function start and end probes
	GoProbes() map[string]ebpfcommon.FunctionPrograms
	// KProbes returns a map with the name of the kernel probes that need to be
	// tapped into. Start matches kprobe, End matches kretprobe
	KProbes() map[string]ebpfcommon.FunctionPrograms
	// KProbes returns a map with the module name mapping to the uprobes that need to be
	// tapped into. Start matches uprobe, End matches uretprobe
	UProbes() map[string]map[string]ebpfcommon.FunctionPrograms
	// Socket filters returns a list of programs that need to be loaded as a
	// generic eBPF socket filter
	SocketFilters() []*ebpf.Program
	// Run will do the action of listening for eBPF traces and forward them
	// periodically to the output channel.
	Run(context.Context, chan<- []request.Span)
	// AddCloser adds io.Closer instances that need to be invoked when the
	// Run function ends.
	AddCloser(c ...io.Closer)
}

Tracer is an individual eBPF program (e.g. the net/http or the grpc tracers)