Comments (6)
This is because pwru fetches pid in kernel space while converts pid to process name in user space, so if the process sending skb is terminated before pwru starts the pid->pname convertion, no process can be found to match pid.
Indeed we can fetch pname in bpf kernel space via task->comm
or task->mm->arg_start
, but that approach might impact performance.
Another easy fix is to cache pname in pwru user space during an skb's lifetime.
from pwru.
Indeed we can fetch pname in bpf kernel space via
task->comm
ortask->mm->arg_start
, but that approach might impact performance.
Probably not worth the trade-off. If this happens only when the process is terminated early, then I'd say it's fine to miss info like the process name, rather than slow down the whole execution.
Another easy fix is to cache pname in pwru user space during an skb's lifetime.
Sounds like a better option to me, for what it's worth.
from pwru.
I was thinking using a user-space map[skb]pname to cache pname conversion, but that actually doesn't make sense because an skb could be transferred between processes (e.g. from a client process to a server process).
Then I thought we could cache map[pid]pname, but the entry eviction is tricky, we should find an appropriate event to delete an pid->pname entry in map, instead of caching the entry forever. LRU? Timer? Tracing the lifetime of a process?
from pwru.
Another easy fix is to cache pname in pwru user space during an skb's lifetime.
Any TL;DR how it would work?
from pwru.
Not sure about others, but TBH for me a process name is very little of use when debugging.
from pwru.
Then I thought we could cache map[pid]pname, but the entry eviction is tricky, we should find an appropriate event to delete an pid->pname entry in map, instead of caching the entry forever. LRU? Timer? Tracing the lifetime of a process?
LRU, don't evict, just read from the cache when you cannot get the pname from the regular conversion method?
Not sure about others, but TBH for me a process name is very little of use when debugging.
Agreed it's nice to have, but not a big issue if it's occasionally broken
from pwru.
Related Issues (20)
- CI: use pwru built by "make release" when testing
- Trace skb with fragments. HOT 1
- Multi-arch container image HOT 3
- Would be nice if probe unloading was faster HOT 6
- Failing to load on bpf-next: calipso_skbuff_delattr: opening perf event: cannot assign requested address HOT 7
- option --filter-trace-tc not support HOT 2
- `cb[]` (array of values) is not printed correctly when dumping the full skb HOT 4
- Support --filter-mark mark/[/mask]
- build error of "LoadKProbeMultiPWRUWithoutOutputSKB" and so on
- Track kfunc with parameter whose type is struct sock * HOT 3
- --filter-trace-tc option doesn't work with Cilium HOT 6
- Support for Openshift 4.12/13? HOT 1
- CPU utilization HOT 1
- Getting errors HOT 1
- CI flake: Test pcap filter using stack
- CI flake: Test --filter-ifname
- Bug: program kprobe_skb_2: load program: permission denied HOT 2
- invalid go version '1.21.0': must match format 1.23 HOT 1
- unrecognized command line option '-m64'
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from pwru.