-
Notifications
You must be signed in to change notification settings - Fork 2
/
tracer_syscall_stats.go
111 lines (93 loc) · 2.74 KB
/
tracer_syscall_stats.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
package ebpftracer
import (
"errors"
"fmt"
"github.com/castai/kvisor/pkg/kernel"
"github.com/castai/kvisor/pkg/systable"
"github.com/cilium/ebpf"
)
type SyscallStatsKeyCgroupID uint64
type SyscallStats struct {
ID SyscallID
Count uint64
}
type SyscallID uint32
func (s SyscallID) String() string {
return systable.List[s]
}
type rawSyscallStatsKey struct {
CgroupID uint64
ID uint64
}
func (t *Tracer) ReadSyscallStats() (map[SyscallStatsKeyCgroupID][]SyscallStats, error) {
out := make(map[SyscallStatsKeyCgroupID][]SyscallStats)
statsMap := t.module.objects.SyscallStatsMap
iterator := statsMap.Iterate()
var (
key rawSyscallStatsKey
value uint64
)
for iterator.Next(&key, &value) {
if key.ID > 340 {
//t.log.Warnf("syscall id=%d not mapped", key.ID)
// TODO: Add metrics and fix this hardcoded value.
continue
}
out[SyscallStatsKeyCgroupID(key.CgroupID)] = append(out[SyscallStatsKeyCgroupID(key.CgroupID)], SyscallStats{
ID: SyscallID(key.ID),
Count: value,
})
}
if err := iterator.Err(); err != nil {
return nil, fmt.Errorf("syscall stats iterator: %w", err)
}
t.cleanupSyscallStats(out)
return out, nil
}
func (t *Tracer) cleanupSyscallStats(stats map[SyscallStatsKeyCgroupID][]SyscallStats) {
var obsoleteStatsKeys []rawSyscallStatsKey
t.removedCgroupsMu.Lock()
for removedCgroupID := range t.removedCgroups {
if st, found := stats[SyscallStatsKeyCgroupID(removedCgroupID)]; found {
for _, syscallStats := range st {
obsoleteStatsKeys = append(obsoleteStatsKeys, rawSyscallStatsKey{
CgroupID: removedCgroupID,
ID: uint64(syscallStats.ID),
})
}
}
}
t.removedCgroupsMu.Unlock()
if len(obsoleteStatsKeys) > 0 {
if err := t.cleanupSyscallStatsKernel(obsoleteStatsKeys); err != nil {
t.log.Errorf("cleanup obsolete syscall stats: %v", err)
} else {
t.removedCgroupsMu.Lock()
t.removedCgroups = map[uint64]struct{}{}
t.removedCgroupsMu.Unlock()
}
}
}
func (t *Tracer) cleanupSyscallStatsKernel(obsoleteStatsKeys []rawSyscallStatsKey) error {
kernelVersion, err := kernel.CurrentKernelVersion()
if err != nil {
return err
}
// The ebpf batch helpers are available since kernel version 5.6.
if kernelVersion.Major > 5 || (kernelVersion.Major == 5 && kernelVersion.Minor >= 6) {
_, err = t.module.objects.SyscallStatsMap.BatchDelete(obsoleteStatsKeys, &ebpf.BatchOptions{})
if err != nil {
if !errors.Is(err, ebpf.ErrKeyNotExist) {
return fmt.Errorf("got error while trying to delete syscall stats: %w", err)
}
}
} else {
for _, key := range obsoleteStatsKeys {
err = t.module.objects.SyscallStatsMap.Delete(key)
if !errors.Is(err, ebpf.ErrKeyNotExist) {
t.log.Warnf("deleting syscall stats: %v", err)
}
}
}
return nil
}