ebpfcommon

Documentation

Index

• func FindNamespace(pid int32) (uint32, error)
• func FindNamespacedPids(pid int32) ([]uint32, error)
• func ForwardRingbuf[T any](service svc.ID, cfg *TracerConfig, logger *slog.Logger, ringbuffer *ebpf.Map, ...) func(context.Context, chan<- []request.Span)
• func HTTPRequestTraceToSpan(trace *HTTPRequestTrace) request.Span
• func ReadHTTPRequestTraceAsSpan(record *ringbuf.Record) (request.Span, bool, error)
• type Filter
  • func (f *Filter) Close() error
• type FunctionPrograms
• type HTTPRequestTrace
• type IdentityPidsFilter
  • func (pf *IdentityPidsFilter) AllowPID(_ uint32)
  • func (pf *IdentityPidsFilter) BlockPID(_ uint32)
  • func (pf *IdentityPidsFilter) CurrentPIDs() map[uint32]map[uint32]struct{}
  • func (pf *IdentityPidsFilter) Filter(inputSpans []request.Span) []request.Span
• type PIDEventOp
• type PIDsFilter
  • func NewPIDsFilter(log *slog.Logger) *PIDsFilter
  • func (pf *PIDsFilter) AllowPID(pid uint32)
  • func (pf *PIDsFilter) BlockPID(pid uint32)
  • func (pf *PIDsFilter) CurrentPIDs() map[uint32]map[uint32]struct{}
  • func (pf *PIDsFilter) Filter(inputSpans []request.Span) []request.Span
• type Probe
• type TracerConfig

Functions

func FindNamespace

func FindNamespace(pid int32) (uint32, error)

func FindNamespacedPids

func FindNamespacedPids(pid int32) ([]uint32, error)

func ForwardRingbuf

func ForwardRingbuf[T any](
	service svc.ID,
	cfg *TracerConfig,
	logger *slog.Logger,
	ringbuffer *ebpf.Map,
	reader func(*ringbuf.Record) (request.Span, bool, error),
	filter func([]request.Span) []request.Span,
	metrics imetrics.Reporter,
	closers ...io.Closer,
) func(context.Context, chan<- []request.Span)

ForwardRingbuf returns a function reads HTTPRequestTraces from an input ring buffer, accumulates them into an internal buffer, and forwards them to an output events channel, previously converted to request.Span instances.

func HTTPRequestTraceToSpan

func HTTPRequestTraceToSpan(trace *HTTPRequestTrace) request.Span

func ReadHTTPRequestTraceAsSpan

func ReadHTTPRequestTraceAsSpan(record *ringbuf.Record) (request.Span, bool, error)

Types

type Filter

type Filter struct {
	io.Closer
	Fd int
}

func (*Filter) Close

func (f *Filter) Close() error

type FunctionPrograms

type FunctionPrograms struct {
	// Required, if true, will cancel the execution of the eBPF Tracer
	// if the function has not been found in the executable
	Required bool
	Start    *ebpf.Program
	End      *ebpf.Program
}

type HTTPRequestTrace

type HTTPRequestTrace bpfHttpRequestTrace

HTTPRequestTrace contains information from an HTTP request as directly received from the eBPF layer. This contains low-level C structures for accurate binary read from ring buffer.

type IdentityPidsFilter

type IdentityPidsFilter struct{}

IdentityPidsFilter is a PIDsFilter that does not filter anything. It is feasible for system-wide instrumenation

func (*IdentityPidsFilter) AllowPID

func (pf *IdentityPidsFilter) AllowPID(_ uint32)

func (*IdentityPidsFilter) BlockPID

func (pf *IdentityPidsFilter) BlockPID(_ uint32)

func (*IdentityPidsFilter) CurrentPIDs

func (pf *IdentityPidsFilter) CurrentPIDs() map[uint32]map[uint32]struct{}

func (*IdentityPidsFilter) Filter

func (pf *IdentityPidsFilter) Filter(inputSpans []request.Span) []request.Span

type PIDEventOp

type PIDEventOp uint8

const (
	ADD PIDEventOp = iota + 1
	DEL
)

type PIDsFilter

type PIDsFilter struct {
	// contains filtered or unexported fields
}

PIDsFilter keeps a thread-safe copy of the PIDs whose traces are allowed to be forwarded. Its Filter method filters the request.Span instances whose PIDs are not in the allowed list.

func NewPIDsFilter

func NewPIDsFilter(log *slog.Logger) *PIDsFilter

func (*PIDsFilter) AllowPID

func (pf *PIDsFilter) AllowPID(pid uint32)

func (*PIDsFilter) BlockPID

func (pf *PIDsFilter) BlockPID(pid uint32)

func (*PIDsFilter) CurrentPIDs

func (pf *PIDsFilter) CurrentPIDs() map[uint32]map[uint32]struct{}

func (*PIDsFilter) Filter

func (pf *PIDsFilter) Filter(inputSpans []request.Span) []request.Span

type Probe

type Probe struct {
	Offsets  goexec.FuncOffsets
	Programs FunctionPrograms
}

Probe holds the information of the instrumentation points of a given function: its start and end offsets and eBPF programs

type TracerConfig

type TracerConfig struct {
	BpfDebug bool `yaml:"bfp_debug" env:"BEYLA_BPF_DEBUG"`

	// WakeupLen specifies how many messages need to be accumulated in the eBPF ringbuffer
	// before sending a wakeup request.
	// High values of WakeupLen could add a noticeable metric delay in services with low
	// requests/second.
	// TODO: see if there is a way to force eBPF to wakeup userspace on timeout
	WakeupLen int `yaml:"wakeup_len" env:"BEYLA_BPF_WAKEUP_LEN"`
	// BatchLength allows specifying how many traces will be batched at the initial
	// stage before being forwarded to the next stage
	BatchLength int `yaml:"batch_length" env:"BEYLA_BPF_BATCH_LENGTH"`
	// BatchTimeout specifies the timeout to forward the data batch if it didn't
	// reach the BatchLength size
	BatchTimeout time.Duration `yaml:"batch_timeout" env:"BEYLA_BPF_BATCH_TIMEOUT"`

	// BpfBaseDir specifies the base directory where the BPF pinned maps will be mounted.
	// By default, it will be /var/run/beyla
	BpfBaseDir string `yaml:"bpf_fs_base_dir" env:"BEYLA_BPF_FS_BASE_DIR"`
}

TracerConfig configuration for eBPF programs