ebpf_vfs.c 86 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984
  1. // SPDX-License-Identifier: GPL-3.0-or-later
  2. #include <sys/resource.h>
  3. #include "ebpf.h"
  4. #include "ebpf_vfs.h"
  5. static char *vfs_dimension_names[NETDATA_KEY_PUBLISH_VFS_END] = { "delete", "read", "write",
  6. "fsync", "open", "create" };
  7. static char *vfs_id_names[NETDATA_KEY_PUBLISH_VFS_END] = { "vfs_unlink", "vfs_read", "vfs_write",
  8. "vfs_fsync", "vfs_open", "vfs_create"};
  9. static netdata_idx_t *vfs_hash_values = NULL;
  10. static netdata_syscall_stat_t vfs_aggregated_data[NETDATA_KEY_PUBLISH_VFS_END];
  11. static netdata_publish_syscall_t vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_END];
  12. netdata_publish_vfs_t **vfs_pid = NULL;
  13. netdata_publish_vfs_t *vfs_vector = NULL;
  14. static ebpf_local_maps_t vfs_maps[] = {{.name = "tbl_vfs_pid", .internal_input = ND_EBPF_DEFAULT_PID_SIZE,
  15. .user_input = 0, .type = NETDATA_EBPF_MAP_RESIZABLE | NETDATA_EBPF_MAP_PID,
  16. .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
  17. {.name = "tbl_vfs_stats", .internal_input = NETDATA_VFS_COUNTER,
  18. .user_input = 0, .type = NETDATA_EBPF_MAP_STATIC,
  19. .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
  20. {.name = "vfs_ctrl", .internal_input = NETDATA_CONTROLLER_END,
  21. .user_input = 0,
  22. .type = NETDATA_EBPF_MAP_CONTROLLER,
  23. .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
  24. {.name = NULL, .internal_input = 0, .user_input = 0}};
  25. struct config vfs_config = { .first_section = NULL,
  26. .last_section = NULL,
  27. .mutex = NETDATA_MUTEX_INITIALIZER,
  28. .index = { .avl_tree = { .root = NULL, .compar = appconfig_section_compare },
  29. .rwlock = AVL_LOCK_INITIALIZER } };
  30. struct netdata_static_thread vfs_threads = {
  31. .name = "VFS KERNEL",
  32. .config_section = NULL,
  33. .config_name = NULL,
  34. .env_name = NULL,
  35. .enabled = 1,
  36. .thread = NULL,
  37. .init_routine = NULL,
  38. .start_routine = NULL
  39. };
  40. netdata_ebpf_targets_t vfs_targets[] = { {.name = "vfs_write", .mode = EBPF_LOAD_TRAMPOLINE},
  41. {.name = "vfs_writev", .mode = EBPF_LOAD_TRAMPOLINE},
  42. {.name = "vfs_read", .mode = EBPF_LOAD_TRAMPOLINE},
  43. {.name = "vfs_readv", .mode = EBPF_LOAD_TRAMPOLINE},
  44. {.name = "vfs_unlink", .mode = EBPF_LOAD_TRAMPOLINE},
  45. {.name = "vfs_fsync", .mode = EBPF_LOAD_TRAMPOLINE},
  46. {.name = "vfs_open", .mode = EBPF_LOAD_TRAMPOLINE},
  47. {.name = "vfs_create", .mode = EBPF_LOAD_TRAMPOLINE},
  48. {.name = "release_task", .mode = EBPF_LOAD_TRAMPOLINE},
  49. {.name = NULL, .mode = EBPF_LOAD_TRAMPOLINE}};
  50. #ifdef LIBBPF_MAJOR_VERSION
  51. #include "includes/vfs.skel.h" // BTF code
  52. static struct vfs_bpf *bpf_obj = NULL;
  53. /**
  54. * Disable probe
  55. *
  56. * Disable all probes to use exclusively another method.
  57. *
  58. * @param obj is the main structure for bpf objects
  59. */
  60. static void ebpf_vfs_disable_probes(struct vfs_bpf *obj)
  61. {
  62. bpf_program__set_autoload(obj->progs.netdata_vfs_write_kprobe, false);
  63. bpf_program__set_autoload(obj->progs.netdata_vfs_write_kretprobe, false);
  64. bpf_program__set_autoload(obj->progs.netdata_vfs_writev_kprobe, false);
  65. bpf_program__set_autoload(obj->progs.netdata_vfs_writev_kretprobe, false);
  66. bpf_program__set_autoload(obj->progs.netdata_vfs_read_kprobe, false);
  67. bpf_program__set_autoload(obj->progs.netdata_vfs_read_kretprobe, false);
  68. bpf_program__set_autoload(obj->progs.netdata_vfs_readv_kprobe, false);
  69. bpf_program__set_autoload(obj->progs.netdata_vfs_readv_kretprobe, false);
  70. bpf_program__set_autoload(obj->progs.netdata_vfs_unlink_kprobe, false);
  71. bpf_program__set_autoload(obj->progs.netdata_vfs_unlink_kretprobe, false);
  72. bpf_program__set_autoload(obj->progs.netdata_vfs_fsync_kprobe, false);
  73. bpf_program__set_autoload(obj->progs.netdata_vfs_fsync_kretprobe, false);
  74. bpf_program__set_autoload(obj->progs.netdata_vfs_open_kprobe, false);
  75. bpf_program__set_autoload(obj->progs.netdata_vfs_open_kretprobe, false);
  76. bpf_program__set_autoload(obj->progs.netdata_vfs_create_kprobe, false);
  77. bpf_program__set_autoload(obj->progs.netdata_vfs_create_kretprobe, false);
  78. bpf_program__set_autoload(obj->progs.netdata_vfs_release_task_kprobe, false);
  79. }
  80. /*
  81. * Disable trampoline
  82. *
  83. * Disable all trampoline to use exclusively another method.
  84. *
  85. * @param obj is the main structure for bpf objects.
  86. */
  87. static void ebpf_vfs_disable_trampoline(struct vfs_bpf *obj)
  88. {
  89. bpf_program__set_autoload(obj->progs.netdata_vfs_write_fentry, false);
  90. bpf_program__set_autoload(obj->progs.netdata_vfs_write_fexit, false);
  91. bpf_program__set_autoload(obj->progs.netdata_vfs_writev_fentry, false);
  92. bpf_program__set_autoload(obj->progs.netdata_vfs_writev_fexit, false);
  93. bpf_program__set_autoload(obj->progs.netdata_vfs_read_fentry, false);
  94. bpf_program__set_autoload(obj->progs.netdata_vfs_read_fexit, false);
  95. bpf_program__set_autoload(obj->progs.netdata_vfs_readv_fentry, false);
  96. bpf_program__set_autoload(obj->progs.netdata_vfs_readv_fexit, false);
  97. bpf_program__set_autoload(obj->progs.netdata_vfs_unlink_fentry, false);
  98. bpf_program__set_autoload(obj->progs.netdata_vfs_fsync_fentry, false);
  99. bpf_program__set_autoload(obj->progs.netdata_vfs_fsync_fexit, false);
  100. bpf_program__set_autoload(obj->progs.netdata_vfs_open_fentry, false);
  101. bpf_program__set_autoload(obj->progs.netdata_vfs_open_fexit, false);
  102. bpf_program__set_autoload(obj->progs.netdata_vfs_create_fentry, false);
  103. bpf_program__set_autoload(obj->progs.netdata_vfs_release_task_fentry, false);
  104. }
  105. /**
  106. * Set trampoline target
  107. *
  108. * Set the targets we will monitor.
  109. *
  110. * @param obj is the main structure for bpf objects.
  111. */
  112. static void ebpf_vfs_set_trampoline_target(struct vfs_bpf *obj)
  113. {
  114. bpf_program__set_attach_target(obj->progs.netdata_vfs_write_fentry, 0, vfs_targets[NETDATA_EBPF_VFS_WRITE].name);
  115. bpf_program__set_attach_target(obj->progs.netdata_vfs_write_fexit, 0, vfs_targets[NETDATA_EBPF_VFS_WRITE].name);
  116. bpf_program__set_attach_target(obj->progs.netdata_vfs_writev_fentry, 0, vfs_targets[NETDATA_EBPF_VFS_WRITEV].name);
  117. bpf_program__set_attach_target(obj->progs.netdata_vfs_writev_fexit, 0, vfs_targets[NETDATA_EBPF_VFS_WRITEV].name);
  118. bpf_program__set_attach_target(obj->progs.netdata_vfs_read_fentry, 0, vfs_targets[NETDATA_EBPF_VFS_READ].name);
  119. bpf_program__set_attach_target(obj->progs.netdata_vfs_read_fexit, 0, vfs_targets[NETDATA_EBPF_VFS_READ].name);
  120. bpf_program__set_attach_target(obj->progs.netdata_vfs_readv_fentry, 0, vfs_targets[NETDATA_EBPF_VFS_READV].name);
  121. bpf_program__set_attach_target(obj->progs.netdata_vfs_readv_fexit, 0, vfs_targets[NETDATA_EBPF_VFS_READV].name);
  122. bpf_program__set_attach_target(obj->progs.netdata_vfs_unlink_fentry, 0, vfs_targets[NETDATA_EBPF_VFS_UNLINK].name);
  123. bpf_program__set_attach_target(obj->progs.netdata_vfs_fsync_fentry, 0, vfs_targets[NETDATA_EBPF_VFS_FSYNC].name);
  124. bpf_program__set_attach_target(obj->progs.netdata_vfs_fsync_fexit, 0, vfs_targets[NETDATA_EBPF_VFS_FSYNC].name);
  125. bpf_program__set_attach_target(obj->progs.netdata_vfs_open_fentry, 0, vfs_targets[NETDATA_EBPF_VFS_OPEN].name);
  126. bpf_program__set_attach_target(obj->progs.netdata_vfs_open_fexit, 0, vfs_targets[NETDATA_EBPF_VFS_OPEN].name);
  127. bpf_program__set_attach_target(obj->progs.netdata_vfs_create_fentry, 0, vfs_targets[NETDATA_EBPF_VFS_CREATE].name);
  128. bpf_program__set_attach_target(obj->progs.netdata_vfs_release_task_fentry, 0, EBPF_COMMON_FNCT_CLEAN_UP);
  129. }
  130. /**
  131. * Attach Probe
  132. *
  133. * Attach probes to target
  134. *
  135. * @param obj is the main structure for bpf objects.
  136. *
  137. * @return It returns 0 on success and -1 otherwise.
  138. */
  139. static int ebpf_vfs_attach_probe(struct vfs_bpf *obj)
  140. {
  141. obj->links.netdata_vfs_write_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_write_kprobe, false,
  142. vfs_targets[NETDATA_EBPF_VFS_WRITE].name);
  143. int ret = libbpf_get_error(obj->links.netdata_vfs_write_kprobe);
  144. if (ret)
  145. return -1;
  146. obj->links.netdata_vfs_write_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_write_kretprobe, true,
  147. vfs_targets[NETDATA_EBPF_VFS_WRITE].name);
  148. ret = libbpf_get_error(obj->links.netdata_vfs_write_kretprobe);
  149. if (ret)
  150. return -1;
  151. obj->links.netdata_vfs_writev_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_writev_kprobe, false,
  152. vfs_targets[NETDATA_EBPF_VFS_WRITEV].name);
  153. ret = libbpf_get_error(obj->links.netdata_vfs_writev_kprobe);
  154. if (ret)
  155. return -1;
  156. obj->links.netdata_vfs_writev_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_writev_kretprobe, true,
  157. vfs_targets[NETDATA_EBPF_VFS_WRITEV].name);
  158. ret = libbpf_get_error(obj->links.netdata_vfs_writev_kretprobe);
  159. if (ret)
  160. return -1;
  161. obj->links.netdata_vfs_read_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_read_kprobe, false,
  162. vfs_targets[NETDATA_EBPF_VFS_READ].name);
  163. ret = libbpf_get_error(obj->links.netdata_vfs_read_kprobe);
  164. if (ret)
  165. return -1;
  166. obj->links.netdata_vfs_read_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_read_kretprobe, true,
  167. vfs_targets[NETDATA_EBPF_VFS_READ].name);
  168. ret = libbpf_get_error(obj->links.netdata_vfs_read_kretprobe);
  169. if (ret)
  170. return -1;
  171. obj->links.netdata_vfs_readv_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_readv_kprobe, false,
  172. vfs_targets[NETDATA_EBPF_VFS_READV].name);
  173. ret = libbpf_get_error(obj->links.netdata_vfs_readv_kprobe);
  174. if (ret)
  175. return -1;
  176. obj->links.netdata_vfs_readv_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_readv_kretprobe, true,
  177. vfs_targets[NETDATA_EBPF_VFS_READV].name);
  178. ret = libbpf_get_error(obj->links.netdata_vfs_readv_kretprobe);
  179. if (ret)
  180. return -1;
  181. obj->links.netdata_vfs_unlink_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_unlink_kprobe, false,
  182. vfs_targets[NETDATA_EBPF_VFS_UNLINK].name);
  183. ret = libbpf_get_error(obj->links.netdata_vfs_unlink_kprobe);
  184. if (ret)
  185. return -1;
  186. obj->links.netdata_vfs_unlink_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_unlink_kretprobe, true,
  187. vfs_targets[NETDATA_EBPF_VFS_UNLINK].name);
  188. ret = libbpf_get_error(obj->links.netdata_vfs_unlink_kretprobe);
  189. if (ret)
  190. return -1;
  191. obj->links.netdata_vfs_fsync_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_fsync_kprobe, false,
  192. vfs_targets[NETDATA_EBPF_VFS_FSYNC].name);
  193. ret = libbpf_get_error(obj->links.netdata_vfs_fsync_kprobe);
  194. if (ret)
  195. return -1;
  196. obj->links.netdata_vfs_fsync_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_fsync_kretprobe, true,
  197. vfs_targets[NETDATA_EBPF_VFS_FSYNC].name);
  198. ret = libbpf_get_error(obj->links.netdata_vfs_fsync_kretprobe);
  199. if (ret)
  200. return -1;
  201. obj->links.netdata_vfs_open_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_open_kprobe, false,
  202. vfs_targets[NETDATA_EBPF_VFS_OPEN].name);
  203. ret = libbpf_get_error(obj->links.netdata_vfs_open_kprobe);
  204. if (ret)
  205. return -1;
  206. obj->links.netdata_vfs_open_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_open_kretprobe, true,
  207. vfs_targets[NETDATA_EBPF_VFS_OPEN].name);
  208. ret = libbpf_get_error(obj->links.netdata_vfs_open_kretprobe);
  209. if (ret)
  210. return -1;
  211. obj->links.netdata_vfs_create_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_create_kprobe, false,
  212. vfs_targets[NETDATA_EBPF_VFS_CREATE].name);
  213. ret = libbpf_get_error(obj->links.netdata_vfs_create_kprobe);
  214. if (ret)
  215. return -1;
  216. obj->links.netdata_vfs_create_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_create_kretprobe, true,
  217. vfs_targets[NETDATA_EBPF_VFS_CREATE].name);
  218. ret = libbpf_get_error(obj->links.netdata_vfs_create_kretprobe);
  219. if (ret)
  220. return -1;
  221. obj->links.netdata_vfs_fsync_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_fsync_kprobe, false,
  222. vfs_targets[NETDATA_EBPF_VFS_FSYNC].name);
  223. ret = libbpf_get_error(obj->links.netdata_vfs_fsync_kprobe);
  224. if (ret)
  225. return -1;
  226. obj->links.netdata_vfs_fsync_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_fsync_kretprobe, true,
  227. vfs_targets[NETDATA_EBPF_VFS_FSYNC].name);
  228. ret = libbpf_get_error(obj->links.netdata_vfs_fsync_kretprobe);
  229. if (ret)
  230. return -1;
  231. obj->links.netdata_vfs_open_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_open_kprobe, false,
  232. vfs_targets[NETDATA_EBPF_VFS_OPEN].name);
  233. ret = libbpf_get_error(obj->links.netdata_vfs_open_kprobe);
  234. if (ret)
  235. return -1;
  236. obj->links.netdata_vfs_open_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_open_kretprobe, true,
  237. vfs_targets[NETDATA_EBPF_VFS_OPEN].name);
  238. ret = libbpf_get_error(obj->links.netdata_vfs_open_kretprobe);
  239. if (ret)
  240. return -1;
  241. obj->links.netdata_vfs_create_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_create_kprobe, false,
  242. vfs_targets[NETDATA_EBPF_VFS_CREATE].name);
  243. ret = libbpf_get_error(obj->links.netdata_vfs_create_kprobe);
  244. if (ret)
  245. return -1;
  246. obj->links.netdata_vfs_create_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_create_kretprobe, true,
  247. vfs_targets[NETDATA_EBPF_VFS_CREATE].name);
  248. ret = libbpf_get_error(obj->links.netdata_vfs_create_kretprobe);
  249. if (ret)
  250. return -1;
  251. obj->links.netdata_vfs_release_task_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_release_task_fentry,
  252. true,
  253. EBPF_COMMON_FNCT_CLEAN_UP);
  254. ret = libbpf_get_error(obj->links.netdata_vfs_release_task_kprobe);
  255. if (ret)
  256. return -1;
  257. return 0;
  258. }
  259. /**
  260. * Adjust Map Size
  261. *
  262. * Resize maps according input from users.
  263. *
  264. * @param obj is the main structure for bpf objects.
  265. * @param em structure with configuration
  266. */
  267. static void ebpf_vfs_adjust_map_size(struct vfs_bpf *obj, ebpf_module_t *em)
  268. {
  269. ebpf_update_map_size(obj->maps.tbl_vfs_pid, &vfs_maps[NETDATA_VFS_PID],
  270. em, bpf_map__name(obj->maps.tbl_vfs_pid));
  271. }
  272. /**
  273. * Set hash tables
  274. *
  275. * Set the values for maps according the value given by kernel.
  276. *
  277. * @param obj is the main structure for bpf objects.
  278. */
  279. static void ebpf_vfs_set_hash_tables(struct vfs_bpf *obj)
  280. {
  281. vfs_maps[NETDATA_VFS_ALL].map_fd = bpf_map__fd(obj->maps.tbl_vfs_stats);
  282. vfs_maps[NETDATA_VFS_PID].map_fd = bpf_map__fd(obj->maps.tbl_vfs_pid);
  283. vfs_maps[NETDATA_VFS_CTRL].map_fd = bpf_map__fd(obj->maps.vfs_ctrl);
  284. }
  285. /**
  286. * Disable Release Task
  287. *
  288. * Disable release task when apps is not enabled.
  289. *
  290. * @param obj is the main structure for bpf objects.
  291. */
  292. static void ebpf_vfs_disable_release_task(struct vfs_bpf *obj)
  293. {
  294. bpf_program__set_autoload(obj->progs.netdata_vfs_release_task_fentry, false);
  295. bpf_program__set_autoload(obj->progs.netdata_vfs_release_task_kprobe, false);
  296. }
  297. /**
  298. * Load and attach
  299. *
  300. * Load and attach the eBPF code in kernel.
  301. *
  302. * @param obj is the main structure for bpf objects.
  303. * @param em structure with configuration
  304. *
  305. * @return it returns 0 on success and -1 otherwise
  306. */
  307. static inline int ebpf_vfs_load_and_attach(struct vfs_bpf *obj, ebpf_module_t *em)
  308. {
  309. netdata_ebpf_targets_t *mt = em->targets;
  310. netdata_ebpf_program_loaded_t test = mt[NETDATA_EBPF_VFS_WRITE].mode;
  311. if (test == EBPF_LOAD_TRAMPOLINE) {
  312. ebpf_vfs_disable_probes(obj);
  313. ebpf_vfs_set_trampoline_target(obj);
  314. } else {
  315. ebpf_vfs_disable_trampoline(obj);
  316. }
  317. ebpf_vfs_adjust_map_size(obj, em);
  318. if (!em->apps_charts && !em->cgroup_charts)
  319. ebpf_vfs_disable_release_task(obj);
  320. int ret = vfs_bpf__load(obj);
  321. if (ret) {
  322. return ret;
  323. }
  324. ret = (test == EBPF_LOAD_TRAMPOLINE) ? vfs_bpf__attach(obj) : ebpf_vfs_attach_probe(obj);
  325. if (!ret) {
  326. ebpf_vfs_set_hash_tables(obj);
  327. ebpf_update_controller(vfs_maps[NETDATA_VFS_CTRL].map_fd, em);
  328. }
  329. return ret;
  330. }
  331. #endif
  332. /*****************************************************************
  333. *
  334. * FUNCTIONS TO CLOSE THE THREAD
  335. *
  336. *****************************************************************/
  337. /**
  338. * Cachestat Free
  339. *
  340. * Cleanup variables after child threads to stop
  341. *
  342. * @param ptr thread data.
  343. */
  344. static void ebpf_vfs_free(ebpf_module_t *em)
  345. {
  346. pthread_mutex_lock(&ebpf_exit_cleanup);
  347. if (em->thread->enabled == NETDATA_THREAD_EBPF_RUNNING) {
  348. em->thread->enabled = NETDATA_THREAD_EBPF_STOPPING;
  349. pthread_mutex_unlock(&ebpf_exit_cleanup);
  350. return;
  351. }
  352. pthread_mutex_unlock(&ebpf_exit_cleanup);
  353. freez(vfs_hash_values);
  354. freez(vfs_vector);
  355. freez(vfs_threads.thread);
  356. #ifdef LIBBPF_MAJOR_VERSION
  357. if (bpf_obj)
  358. vfs_bpf__destroy(bpf_obj);
  359. #endif
  360. pthread_mutex_lock(&ebpf_exit_cleanup);
  361. em->thread->enabled = NETDATA_THREAD_EBPF_STOPPED;
  362. pthread_mutex_unlock(&ebpf_exit_cleanup);
  363. }
  364. /**
  365. * Exit
  366. *
  367. * Cancel thread and exit.
  368. *
  369. * @param ptr thread data.
  370. **/
  371. static void ebpf_vfs_exit(void *ptr)
  372. {
  373. ebpf_module_t *em = (ebpf_module_t *)ptr;
  374. if (vfs_threads.thread)
  375. netdata_thread_cancel(*vfs_threads.thread);
  376. ebpf_vfs_free(em);
  377. }
  378. /**
  379. * Clean up the main thread.
  380. *
  381. * @param ptr thread data.
  382. **/
  383. static void ebpf_vfs_cleanup(void *ptr)
  384. {
  385. ebpf_module_t *em = (ebpf_module_t *)ptr;
  386. ebpf_vfs_free(em);
  387. }
  388. /*****************************************************************
  389. *
  390. * FUNCTIONS WITH THE MAIN LOOP
  391. *
  392. *****************************************************************/
  393. /**
  394. * Send data to Netdata calling auxiliary functions.
  395. *
  396. * @param em the structure with thread information
  397. */
  398. static void ebpf_vfs_send_data(ebpf_module_t *em)
  399. {
  400. netdata_publish_vfs_common_t pvc;
  401. pvc.write = (long)vfs_aggregated_data[NETDATA_KEY_PUBLISH_VFS_WRITE].bytes;
  402. pvc.read = (long)vfs_aggregated_data[NETDATA_KEY_PUBLISH_VFS_READ].bytes;
  403. write_count_chart(NETDATA_VFS_FILE_CLEAN_COUNT, NETDATA_FILESYSTEM_FAMILY,
  404. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_UNLINK], 1);
  405. write_count_chart(NETDATA_VFS_FILE_IO_COUNT, NETDATA_FILESYSTEM_FAMILY,
  406. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ], 2);
  407. if (em->mode < MODE_ENTRY) {
  408. write_err_chart(NETDATA_VFS_FILE_ERR_COUNT, NETDATA_FILESYSTEM_FAMILY,
  409. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ], 2);
  410. }
  411. write_io_chart(NETDATA_VFS_IO_FILE_BYTES, NETDATA_FILESYSTEM_FAMILY, vfs_id_names[NETDATA_KEY_PUBLISH_VFS_WRITE],
  412. (long long)pvc.write, vfs_id_names[NETDATA_KEY_PUBLISH_VFS_READ], (long long)pvc.read);
  413. write_count_chart(NETDATA_VFS_FSYNC, NETDATA_FILESYSTEM_FAMILY,
  414. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_FSYNC], 1);
  415. if (em->mode < MODE_ENTRY) {
  416. write_err_chart(NETDATA_VFS_FSYNC_ERR, NETDATA_FILESYSTEM_FAMILY,
  417. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_FSYNC], 1);
  418. }
  419. write_count_chart(NETDATA_VFS_OPEN, NETDATA_FILESYSTEM_FAMILY,
  420. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_OPEN], 1);
  421. if (em->mode < MODE_ENTRY) {
  422. write_err_chart(NETDATA_VFS_OPEN_ERR, NETDATA_FILESYSTEM_FAMILY,
  423. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_OPEN], 1);
  424. }
  425. write_count_chart(NETDATA_VFS_CREATE, NETDATA_FILESYSTEM_FAMILY,
  426. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_CREATE], 1);
  427. if (em->mode < MODE_ENTRY) {
  428. write_err_chart(
  429. NETDATA_VFS_CREATE_ERR,
  430. NETDATA_FILESYSTEM_FAMILY,
  431. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_CREATE],
  432. 1);
  433. }
  434. }
  435. /**
  436. * Read the hash table and store data to allocated vectors.
  437. */
  438. static void read_global_table()
  439. {
  440. uint64_t idx;
  441. netdata_idx_t res[NETDATA_VFS_COUNTER];
  442. netdata_idx_t *val = vfs_hash_values;
  443. int fd = vfs_maps[NETDATA_VFS_ALL].map_fd;
  444. for (idx = 0; idx < NETDATA_VFS_COUNTER; idx++) {
  445. uint64_t total = 0;
  446. if (!bpf_map_lookup_elem(fd, &idx, val)) {
  447. int i;
  448. int end = ebpf_nprocs;
  449. for (i = 0; i < end; i++)
  450. total += val[i];
  451. }
  452. res[idx] = total;
  453. }
  454. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_UNLINK].ncall = res[NETDATA_KEY_CALLS_VFS_UNLINK];
  455. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ].ncall = res[NETDATA_KEY_CALLS_VFS_READ] +
  456. res[NETDATA_KEY_CALLS_VFS_READV];
  457. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_WRITE].ncall = res[NETDATA_KEY_CALLS_VFS_WRITE] +
  458. res[NETDATA_KEY_CALLS_VFS_WRITEV];
  459. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_FSYNC].ncall = res[NETDATA_KEY_CALLS_VFS_FSYNC];
  460. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_OPEN].ncall = res[NETDATA_KEY_CALLS_VFS_OPEN];
  461. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_CREATE].ncall = res[NETDATA_KEY_CALLS_VFS_CREATE];
  462. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_UNLINK].nerr = res[NETDATA_KEY_ERROR_VFS_UNLINK];
  463. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ].nerr = res[NETDATA_KEY_ERROR_VFS_READ] +
  464. res[NETDATA_KEY_ERROR_VFS_READV];
  465. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_WRITE].nerr = res[NETDATA_KEY_ERROR_VFS_WRITE] +
  466. res[NETDATA_KEY_ERROR_VFS_WRITEV];
  467. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_FSYNC].nerr = res[NETDATA_KEY_ERROR_VFS_FSYNC];
  468. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_OPEN].nerr = res[NETDATA_KEY_ERROR_VFS_OPEN];
  469. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_CREATE].nerr = res[NETDATA_KEY_ERROR_VFS_CREATE];
  470. vfs_aggregated_data[NETDATA_KEY_PUBLISH_VFS_WRITE].bytes = (uint64_t)res[NETDATA_KEY_BYTES_VFS_WRITE] +
  471. (uint64_t)res[NETDATA_KEY_BYTES_VFS_WRITEV];
  472. vfs_aggregated_data[NETDATA_KEY_PUBLISH_VFS_READ].bytes = (uint64_t)res[NETDATA_KEY_BYTES_VFS_READ] +
  473. (uint64_t)res[NETDATA_KEY_BYTES_VFS_READV];
  474. }
  475. /**
  476. * Sum PIDs
  477. *
  478. * Sum values for all targets.
  479. *
  480. * @param swap output structure
  481. * @param root link list with structure to be used
  482. */
  483. static void ebpf_vfs_sum_pids(netdata_publish_vfs_t *vfs, struct pid_on_target *root)
  484. {
  485. netdata_publish_vfs_t accumulator;
  486. memset(&accumulator, 0, sizeof(accumulator));
  487. while (root) {
  488. int32_t pid = root->pid;
  489. netdata_publish_vfs_t *w = vfs_pid[pid];
  490. if (w) {
  491. accumulator.write_call += w->write_call;
  492. accumulator.writev_call += w->writev_call;
  493. accumulator.read_call += w->read_call;
  494. accumulator.readv_call += w->readv_call;
  495. accumulator.unlink_call += w->unlink_call;
  496. accumulator.fsync_call += w->fsync_call;
  497. accumulator.open_call += w->open_call;
  498. accumulator.create_call += w->create_call;
  499. accumulator.write_bytes += w->write_bytes;
  500. accumulator.writev_bytes += w->writev_bytes;
  501. accumulator.read_bytes += w->read_bytes;
  502. accumulator.readv_bytes += w->readv_bytes;
  503. accumulator.write_err += w->write_err;
  504. accumulator.writev_err += w->writev_err;
  505. accumulator.read_err += w->read_err;
  506. accumulator.readv_err += w->readv_err;
  507. accumulator.unlink_err += w->unlink_err;
  508. accumulator.fsync_err += w->fsync_err;
  509. accumulator.open_err += w->open_err;
  510. accumulator.create_err += w->create_err;
  511. }
  512. root = root->next;
  513. }
  514. // These conditions were added, because we are using incremental algorithm
  515. vfs->write_call = (accumulator.write_call >= vfs->write_call) ? accumulator.write_call : vfs->write_call;
  516. vfs->writev_call = (accumulator.writev_call >= vfs->writev_call) ? accumulator.writev_call : vfs->writev_call;
  517. vfs->read_call = (accumulator.read_call >= vfs->read_call) ? accumulator.read_call : vfs->read_call;
  518. vfs->readv_call = (accumulator.readv_call >= vfs->readv_call) ? accumulator.readv_call : vfs->readv_call;
  519. vfs->unlink_call = (accumulator.unlink_call >= vfs->unlink_call) ? accumulator.unlink_call : vfs->unlink_call;
  520. vfs->fsync_call = (accumulator.fsync_call >= vfs->fsync_call) ? accumulator.fsync_call : vfs->fsync_call;
  521. vfs->open_call = (accumulator.open_call >= vfs->open_call) ? accumulator.open_call : vfs->open_call;
  522. vfs->create_call = (accumulator.create_call >= vfs->create_call) ? accumulator.create_call : vfs->create_call;
  523. vfs->write_bytes = (accumulator.write_bytes >= vfs->write_bytes) ? accumulator.write_bytes : vfs->write_bytes;
  524. vfs->writev_bytes = (accumulator.writev_bytes >= vfs->writev_bytes) ? accumulator.writev_bytes : vfs->writev_bytes;
  525. vfs->read_bytes = (accumulator.read_bytes >= vfs->read_bytes) ? accumulator.read_bytes : vfs->read_bytes;
  526. vfs->readv_bytes = (accumulator.readv_bytes >= vfs->readv_bytes) ? accumulator.readv_bytes : vfs->readv_bytes;
  527. vfs->write_err = (accumulator.write_err >= vfs->write_err) ? accumulator.write_err : vfs->write_err;
  528. vfs->writev_err = (accumulator.writev_err >= vfs->writev_err) ? accumulator.writev_err : vfs->writev_err;
  529. vfs->read_err = (accumulator.read_err >= vfs->read_err) ? accumulator.read_err : vfs->read_err;
  530. vfs->readv_err = (accumulator.readv_err >= vfs->readv_err) ? accumulator.readv_err : vfs->readv_err;
  531. vfs->unlink_err = (accumulator.unlink_err >= vfs->unlink_err) ? accumulator.unlink_err : vfs->unlink_err;
  532. vfs->fsync_err = (accumulator.fsync_err >= vfs->fsync_err) ? accumulator.fsync_err : vfs->fsync_err;
  533. vfs->open_err = (accumulator.open_err >= vfs->open_err) ? accumulator.open_err : vfs->open_err;
  534. vfs->create_err = (accumulator.create_err >= vfs->create_err) ? accumulator.create_err : vfs->create_err;
  535. }
  536. /**
  537. * Send data to Netdata calling auxiliary functions.
  538. *
  539. * @param em the structure with thread information
  540. * @param root the target list.
  541. */
  542. void ebpf_vfs_send_apps_data(ebpf_module_t *em, struct target *root)
  543. {
  544. struct target *w;
  545. for (w = root; w; w = w->next) {
  546. if (unlikely(w->exposed && w->processes)) {
  547. ebpf_vfs_sum_pids(&w->vfs, w->root_pid);
  548. }
  549. }
  550. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_FILE_DELETED);
  551. for (w = root; w; w = w->next) {
  552. if (unlikely(w->exposed && w->processes)) {
  553. write_chart_dimension(w->name, w->vfs.unlink_call);
  554. }
  555. }
  556. write_end_chart();
  557. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS);
  558. for (w = root; w; w = w->next) {
  559. if (unlikely(w->exposed && w->processes)) {
  560. write_chart_dimension(w->name, w->vfs.write_call + w->vfs.writev_call);
  561. }
  562. }
  563. write_end_chart();
  564. if (em->mode < MODE_ENTRY) {
  565. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS_ERROR);
  566. for (w = root; w; w = w->next) {
  567. if (unlikely(w->exposed && w->processes)) {
  568. write_chart_dimension(w->name, w->vfs.write_err + w->vfs.writev_err);
  569. }
  570. }
  571. write_end_chart();
  572. }
  573. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_READ_CALLS);
  574. for (w = root; w; w = w->next) {
  575. if (unlikely(w->exposed && w->processes)) {
  576. write_chart_dimension(w->name, w->vfs.read_call + w->vfs.readv_call);
  577. }
  578. }
  579. write_end_chart();
  580. if (em->mode < MODE_ENTRY) {
  581. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_READ_CALLS_ERROR);
  582. for (w = root; w; w = w->next) {
  583. if (unlikely(w->exposed && w->processes)) {
  584. write_chart_dimension(w->name, w->vfs.read_err + w->vfs.readv_err);
  585. }
  586. }
  587. write_end_chart();
  588. }
  589. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_WRITE_BYTES);
  590. for (w = root; w; w = w->next) {
  591. if (unlikely(w->exposed && w->processes)) {
  592. write_chart_dimension(w->name, w->vfs.write_bytes + w->vfs.writev_bytes);
  593. }
  594. }
  595. write_end_chart();
  596. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_READ_BYTES);
  597. for (w = root; w; w = w->next) {
  598. if (unlikely(w->exposed && w->processes)) {
  599. write_chart_dimension(w->name, w->vfs.read_bytes + w->vfs.readv_bytes);
  600. }
  601. }
  602. write_end_chart();
  603. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_FSYNC);
  604. for (w = root; w; w = w->next) {
  605. if (unlikely(w->exposed && w->processes)) {
  606. write_chart_dimension(w->name, w->vfs.fsync_call);
  607. }
  608. }
  609. write_end_chart();
  610. if (em->mode < MODE_ENTRY) {
  611. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_FSYNC_CALLS_ERROR);
  612. for (w = root; w; w = w->next) {
  613. if (unlikely(w->exposed && w->processes)) {
  614. write_chart_dimension(w->name, w->vfs.fsync_err);
  615. }
  616. }
  617. write_end_chart();
  618. }
  619. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_OPEN);
  620. for (w = root; w; w = w->next) {
  621. if (unlikely(w->exposed && w->processes)) {
  622. write_chart_dimension(w->name, w->vfs.open_call);
  623. }
  624. }
  625. write_end_chart();
  626. if (em->mode < MODE_ENTRY) {
  627. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_OPEN_CALLS_ERROR);
  628. for (w = root; w; w = w->next) {
  629. if (unlikely(w->exposed && w->processes)) {
  630. write_chart_dimension(w->name, w->vfs.open_err);
  631. }
  632. }
  633. write_end_chart();
  634. }
  635. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_CREATE);
  636. for (w = root; w; w = w->next) {
  637. if (unlikely(w->exposed && w->processes)) {
  638. write_chart_dimension(w->name, w->vfs.create_call);
  639. }
  640. }
  641. write_end_chart();
  642. if (em->mode < MODE_ENTRY) {
  643. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_CREATE_CALLS_ERROR);
  644. for (w = root; w; w = w->next) {
  645. if (unlikely(w->exposed && w->processes)) {
  646. write_chart_dimension(w->name, w->vfs.create_err);
  647. }
  648. }
  649. write_end_chart();
  650. }
  651. }
  652. /**
  653. * Apps Accumulator
  654. *
  655. * Sum all values read from kernel and store in the first address.
  656. *
  657. * @param out the vector with read values.
  658. */
  659. static void vfs_apps_accumulator(netdata_publish_vfs_t *out)
  660. {
  661. int i, end = (running_on_kernel >= NETDATA_KERNEL_V4_15) ? ebpf_nprocs : 1;
  662. netdata_publish_vfs_t *total = &out[0];
  663. for (i = 1; i < end; i++) {
  664. netdata_publish_vfs_t *w = &out[i];
  665. total->write_call += w->write_call;
  666. total->writev_call += w->writev_call;
  667. total->read_call += w->read_call;
  668. total->readv_call += w->readv_call;
  669. total->unlink_call += w->unlink_call;
  670. total->write_bytes += w->write_bytes;
  671. total->writev_bytes += w->writev_bytes;
  672. total->read_bytes += w->read_bytes;
  673. total->readv_bytes += w->readv_bytes;
  674. total->write_err += w->write_err;
  675. total->writev_err += w->writev_err;
  676. total->read_err += w->read_err;
  677. total->readv_err += w->readv_err;
  678. total->unlink_err += w->unlink_err;
  679. }
  680. }
  681. /**
  682. * Fill PID
  683. *
  684. * Fill PID structures
  685. *
  686. * @param current_pid pid that we are collecting data
  687. * @param out values read from hash tables;
  688. */
  689. static void vfs_fill_pid(uint32_t current_pid, netdata_publish_vfs_t *publish)
  690. {
  691. netdata_publish_vfs_t *curr = vfs_pid[current_pid];
  692. if (!curr) {
  693. curr = callocz(1, sizeof(netdata_publish_vfs_t));
  694. vfs_pid[current_pid] = curr;
  695. }
  696. memcpy(curr, &publish[0], sizeof(netdata_publish_vfs_t));
  697. }
  698. /**
  699. * Read the hash table and store data to allocated vectors.
  700. */
  701. static void ebpf_vfs_read_apps()
  702. {
  703. struct pid_stat *pids = root_of_pids;
  704. netdata_publish_vfs_t *vv = vfs_vector;
  705. int fd = vfs_maps[NETDATA_VFS_PID].map_fd;
  706. size_t length = sizeof(netdata_publish_vfs_t) * ebpf_nprocs;
  707. while (pids) {
  708. uint32_t key = pids->pid;
  709. if (bpf_map_lookup_elem(fd, &key, vv)) {
  710. pids = pids->next;
  711. continue;
  712. }
  713. vfs_apps_accumulator(vv);
  714. vfs_fill_pid(key, vv);
  715. // We are cleaning to avoid passing data read from one process to other.
  716. memset(vv, 0, length);
  717. pids = pids->next;
  718. }
  719. }
  720. /**
  721. * Update cgroup
  722. *
  723. * Update cgroup data based in
  724. */
  725. static void read_update_vfs_cgroup()
  726. {
  727. ebpf_cgroup_target_t *ect ;
  728. netdata_publish_vfs_t *vv = vfs_vector;
  729. int fd = vfs_maps[NETDATA_VFS_PID].map_fd;
  730. size_t length = sizeof(netdata_publish_vfs_t) * ebpf_nprocs;
  731. pthread_mutex_lock(&mutex_cgroup_shm);
  732. for (ect = ebpf_cgroup_pids; ect; ect = ect->next) {
  733. struct pid_on_target2 *pids;
  734. for (pids = ect->pids; pids; pids = pids->next) {
  735. int pid = pids->pid;
  736. netdata_publish_vfs_t *out = &pids->vfs;
  737. if (likely(vfs_pid) && vfs_pid[pid]) {
  738. netdata_publish_vfs_t *in = vfs_pid[pid];
  739. memcpy(out, in, sizeof(netdata_publish_vfs_t));
  740. } else {
  741. memset(vv, 0, length);
  742. if (!bpf_map_lookup_elem(fd, &pid, vv)) {
  743. vfs_apps_accumulator(vv);
  744. memcpy(out, vv, sizeof(netdata_publish_vfs_t));
  745. }
  746. }
  747. }
  748. }
  749. pthread_mutex_unlock(&mutex_cgroup_shm);
  750. }
  751. /**
  752. * VFS read hash
  753. *
  754. * This is the thread callback.
  755. * This thread is necessary, because we cannot freeze the whole plugin to read the data.
  756. *
  757. * @param ptr It is a NULL value for this thread.
  758. *
  759. * @return It always returns NULL.
  760. */
  761. void *ebpf_vfs_read_hash(void *ptr)
  762. {
  763. netdata_thread_cleanup_push(ebpf_vfs_cleanup, ptr);
  764. heartbeat_t hb;
  765. heartbeat_init(&hb);
  766. ebpf_module_t *em = (ebpf_module_t *)ptr;
  767. usec_t step = NETDATA_LATENCY_VFS_SLEEP_MS * em->update_every;
  768. //This will be cancelled by its parent
  769. while (!ebpf_exit_plugin) {
  770. (void)heartbeat_next(&hb, step);
  771. read_global_table();
  772. }
  773. netdata_thread_cleanup_pop(1);
  774. return NULL;
  775. }
  776. /**
  777. * Sum PIDs
  778. *
  779. * Sum values for all targets.
  780. *
  781. * @param vfs structure used to store data
  782. * @param pids input data
  783. */
  784. static void ebpf_vfs_sum_cgroup_pids(netdata_publish_vfs_t *vfs, struct pid_on_target2 *pids)
  785. {
  786. netdata_publish_vfs_t accumulator;
  787. memset(&accumulator, 0, sizeof(accumulator));
  788. while (pids) {
  789. netdata_publish_vfs_t *w = &pids->vfs;
  790. accumulator.write_call += w->write_call;
  791. accumulator.writev_call += w->writev_call;
  792. accumulator.read_call += w->read_call;
  793. accumulator.readv_call += w->readv_call;
  794. accumulator.unlink_call += w->unlink_call;
  795. accumulator.fsync_call += w->fsync_call;
  796. accumulator.open_call += w->open_call;
  797. accumulator.create_call += w->create_call;
  798. accumulator.write_bytes += w->write_bytes;
  799. accumulator.writev_bytes += w->writev_bytes;
  800. accumulator.read_bytes += w->read_bytes;
  801. accumulator.readv_bytes += w->readv_bytes;
  802. accumulator.write_err += w->write_err;
  803. accumulator.writev_err += w->writev_err;
  804. accumulator.read_err += w->read_err;
  805. accumulator.readv_err += w->readv_err;
  806. accumulator.unlink_err += w->unlink_err;
  807. accumulator.fsync_err += w->fsync_err;
  808. accumulator.open_err += w->open_err;
  809. accumulator.create_err += w->create_err;
  810. pids = pids->next;
  811. }
  812. // These conditions were added, because we are using incremental algorithm
  813. vfs->write_call = (accumulator.write_call >= vfs->write_call) ? accumulator.write_call : vfs->write_call;
  814. vfs->writev_call = (accumulator.writev_call >= vfs->writev_call) ? accumulator.writev_call : vfs->writev_call;
  815. vfs->read_call = (accumulator.read_call >= vfs->read_call) ? accumulator.read_call : vfs->read_call;
  816. vfs->readv_call = (accumulator.readv_call >= vfs->readv_call) ? accumulator.readv_call : vfs->readv_call;
  817. vfs->unlink_call = (accumulator.unlink_call >= vfs->unlink_call) ? accumulator.unlink_call : vfs->unlink_call;
  818. vfs->fsync_call = (accumulator.fsync_call >= vfs->fsync_call) ? accumulator.fsync_call : vfs->fsync_call;
  819. vfs->open_call = (accumulator.open_call >= vfs->open_call) ? accumulator.open_call : vfs->open_call;
  820. vfs->create_call = (accumulator.create_call >= vfs->create_call) ? accumulator.create_call : vfs->create_call;
  821. vfs->write_bytes = (accumulator.write_bytes >= vfs->write_bytes) ? accumulator.write_bytes : vfs->write_bytes;
  822. vfs->writev_bytes = (accumulator.writev_bytes >= vfs->writev_bytes) ? accumulator.writev_bytes : vfs->writev_bytes;
  823. vfs->read_bytes = (accumulator.read_bytes >= vfs->read_bytes) ? accumulator.read_bytes : vfs->read_bytes;
  824. vfs->readv_bytes = (accumulator.readv_bytes >= vfs->readv_bytes) ? accumulator.readv_bytes : vfs->readv_bytes;
  825. vfs->write_err = (accumulator.write_err >= vfs->write_err) ? accumulator.write_err : vfs->write_err;
  826. vfs->writev_err = (accumulator.writev_err >= vfs->writev_err) ? accumulator.writev_err : vfs->writev_err;
  827. vfs->read_err = (accumulator.read_err >= vfs->read_err) ? accumulator.read_err : vfs->read_err;
  828. vfs->readv_err = (accumulator.readv_err >= vfs->readv_err) ? accumulator.readv_err : vfs->readv_err;
  829. vfs->unlink_err = (accumulator.unlink_err >= vfs->unlink_err) ? accumulator.unlink_err : vfs->unlink_err;
  830. vfs->fsync_err = (accumulator.fsync_err >= vfs->fsync_err) ? accumulator.fsync_err : vfs->fsync_err;
  831. vfs->open_err = (accumulator.open_err >= vfs->open_err) ? accumulator.open_err : vfs->open_err;
  832. vfs->create_err = (accumulator.create_err >= vfs->create_err) ? accumulator.create_err : vfs->create_err;
  833. }
  834. /**
  835. * Create specific VFS charts
  836. *
  837. * Create charts for cgroup/application.
  838. *
  839. * @param type the chart type.
  840. * @param em the main thread structure.
  841. */
  842. static void ebpf_create_specific_vfs_charts(char *type, ebpf_module_t *em)
  843. {
  844. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_FILE_DELETED,"Files deleted",
  845. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_UNLINK_CONTEXT,
  846. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5500,
  847. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_UNLINK],
  848. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  849. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS, "Write to disk",
  850. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_WRITE_CONTEXT,
  851. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5501,
  852. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_WRITE],
  853. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  854. if (em->mode < MODE_ENTRY) {
  855. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS_ERROR, "Fails to write",
  856. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_WRITE_ERROR_CONTEXT,
  857. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5502,
  858. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_WRITE],
  859. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  860. }
  861. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_READ_CALLS, "Read from disk",
  862. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_READ_CONTEXT,
  863. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5503,
  864. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ],
  865. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  866. if (em->mode < MODE_ENTRY) {
  867. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_READ_CALLS_ERROR, "Fails to read",
  868. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_READ_ERROR_CONTEXT,
  869. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5504,
  870. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ],
  871. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  872. }
  873. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_WRITE_BYTES, "Bytes written on disk",
  874. EBPF_COMMON_DIMENSION_BYTES, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_WRITE_BYTES_CONTEXT,
  875. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5505,
  876. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_WRITE],
  877. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  878. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_READ_BYTES, "Bytes read from disk",
  879. EBPF_COMMON_DIMENSION_BYTES, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_READ_BYTES_CONTEXT,
  880. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5506,
  881. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ],
  882. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  883. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_FSYNC, "Calls for <code>vfs_fsync</code>",
  884. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_FSYNC_CONTEXT,
  885. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5507,
  886. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_FSYNC],
  887. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  888. if (em->mode < MODE_ENTRY) {
  889. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_FSYNC_CALLS_ERROR, "Sync error",
  890. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_FSYNC_ERROR_CONTEXT,
  891. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5508,
  892. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_FSYNC],
  893. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  894. }
  895. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_OPEN, "Calls for <code>vfs_open</code>",
  896. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_OPEN_CONTEXT,
  897. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5509,
  898. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_OPEN],
  899. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  900. if (em->mode < MODE_ENTRY) {
  901. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_OPEN_CALLS_ERROR, "Open error",
  902. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_OPEN_ERROR_CONTEXT,
  903. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5510,
  904. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_OPEN],
  905. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  906. }
  907. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_CREATE, "Calls for <code>vfs_create</code>",
  908. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_CREATE_CONTEXT,
  909. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5511,
  910. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_CREATE],
  911. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  912. if (em->mode < MODE_ENTRY) {
  913. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_CREATE_CALLS_ERROR, "Create error",
  914. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_CREATE_ERROR_CONTEXT,
  915. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5512,
  916. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_CREATE],
  917. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  918. }
  919. }
  920. /**
  921. * Obsolete specific VFS charts
  922. *
  923. * Obsolete charts for cgroup/application.
  924. *
  925. * @param type the chart type.
  926. * @param em the main thread structure.
  927. */
  928. static void ebpf_obsolete_specific_vfs_charts(char *type, ebpf_module_t *em)
  929. {
  930. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_FILE_DELETED, "Files deleted",
  931. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_GROUP,
  932. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_UNLINK_CONTEXT,
  933. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5500, em->update_every);
  934. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS, "Write to disk",
  935. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_GROUP,
  936. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_WRITE_CONTEXT,
  937. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5501, em->update_every);
  938. if (em->mode < MODE_ENTRY) {
  939. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS_ERROR, "Fails to write",
  940. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_GROUP,
  941. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_WRITE_ERROR_CONTEXT,
  942. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5502, em->update_every);
  943. }
  944. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_READ_CALLS, "Read from disk",
  945. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_GROUP,
  946. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_READ_CONTEXT,
  947. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5503, em->update_every);
  948. if (em->mode < MODE_ENTRY) {
  949. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_READ_CALLS_ERROR, "Fails to read",
  950. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_GROUP,
  951. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_READ_ERROR_CONTEXT,
  952. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5504, em->update_every);
  953. }
  954. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_WRITE_BYTES, "Bytes written on disk",
  955. EBPF_COMMON_DIMENSION_BYTES, NETDATA_VFS_GROUP,
  956. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_WRITE_BYTES_CONTEXT,
  957. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5505, em->update_every);
  958. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_READ_BYTES, "Bytes read from disk",
  959. EBPF_COMMON_DIMENSION_BYTES, NETDATA_VFS_GROUP,
  960. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_READ_BYTES_CONTEXT,
  961. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5506, em->update_every);
  962. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_FSYNC, "Calls for <code>vfs_fsync</code>",
  963. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_GROUP,
  964. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_FSYNC_CONTEXT,
  965. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5507, em->update_every);
  966. if (em->mode < MODE_ENTRY) {
  967. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_FSYNC_CALLS_ERROR, "Sync error",
  968. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_GROUP,
  969. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_FSYNC_ERROR_CONTEXT,
  970. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5508, em->update_every);
  971. }
  972. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_OPEN, "Calls for <code>vfs_open</code>",
  973. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_GROUP,
  974. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_OPEN_CONTEXT,
  975. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5509, em->update_every);
  976. if (em->mode < MODE_ENTRY) {
  977. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_OPEN_CALLS_ERROR, "Open error",
  978. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_GROUP,
  979. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_OPEN_ERROR_CONTEXT,
  980. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5510, em->update_every);
  981. }
  982. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_CREATE, "Calls for <code>vfs_create</code>",
  983. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_GROUP,
  984. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_CREATE_CONTEXT,
  985. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5511, em->update_every);
  986. if (em->mode < MODE_ENTRY) {
  987. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_CREATE_CALLS_ERROR, "Create error",
  988. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_GROUP,
  989. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_CREATE_ERROR_CONTEXT,
  990. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5512, em->update_every);
  991. }
  992. }
  993. /*
  994. * Send specific VFS data
  995. *
  996. * Send data for specific cgroup/apps.
  997. *
  998. * @param type chart type
  999. * @param values structure with values that will be sent to netdata
  1000. */
  1001. static void ebpf_send_specific_vfs_data(char *type, netdata_publish_vfs_t *values, ebpf_module_t *em)
  1002. {
  1003. write_begin_chart(type, NETDATA_SYSCALL_APPS_FILE_DELETED);
  1004. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_UNLINK].name, (long long)values->unlink_call);
  1005. write_end_chart();
  1006. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS);
  1007. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_WRITE].name,
  1008. (long long)values->write_call + (long long)values->writev_call);
  1009. write_end_chart();
  1010. if (em->mode < MODE_ENTRY) {
  1011. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS_ERROR);
  1012. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_WRITE].name,
  1013. (long long)values->write_err + (long long)values->writev_err);
  1014. write_end_chart();
  1015. }
  1016. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_READ_CALLS);
  1017. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ].name,
  1018. (long long)values->read_call + (long long)values->readv_call);
  1019. write_end_chart();
  1020. if (em->mode < MODE_ENTRY) {
  1021. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_READ_CALLS_ERROR);
  1022. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ].name,
  1023. (long long)values->read_err + (long long)values->readv_err);
  1024. write_end_chart();
  1025. }
  1026. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_WRITE_BYTES);
  1027. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_WRITE].name,
  1028. (long long)values->write_bytes + (long long)values->writev_bytes);
  1029. write_end_chart();
  1030. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_READ_BYTES);
  1031. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ].name,
  1032. (long long)values->read_bytes + (long long)values->readv_bytes);
  1033. write_end_chart();
  1034. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_FSYNC);
  1035. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_FSYNC].name,
  1036. (long long)values->fsync_call);
  1037. write_end_chart();
  1038. if (em->mode < MODE_ENTRY) {
  1039. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_FSYNC_CALLS_ERROR);
  1040. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_FSYNC].name,
  1041. (long long)values->fsync_err);
  1042. write_end_chart();
  1043. }
  1044. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_OPEN);
  1045. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_OPEN].name,
  1046. (long long)values->open_call);
  1047. write_end_chart();
  1048. if (em->mode < MODE_ENTRY) {
  1049. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_OPEN_CALLS_ERROR);
  1050. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_OPEN].name,
  1051. (long long)values->open_err);
  1052. write_end_chart();
  1053. }
  1054. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_CREATE);
  1055. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_CREATE].name,
  1056. (long long)values->create_call);
  1057. write_end_chart();
  1058. if (em->mode < MODE_ENTRY) {
  1059. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_CREATE_CALLS_ERROR);
  1060. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_CREATE].name,
  1061. (long long)values->create_err);
  1062. write_end_chart();
  1063. }
  1064. }
  1065. /**
  1066. * Create Systemd Socket Charts
  1067. *
  1068. * Create charts when systemd is enabled
  1069. *
  1070. * @param em the main collector structure
  1071. **/
  1072. static void ebpf_create_systemd_vfs_charts(ebpf_module_t *em)
  1073. {
  1074. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_FILE_DELETED, "Files deleted",
  1075. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP,
  1076. NETDATA_EBPF_CHART_TYPE_STACKED, 20065,
  1077. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_VFS_UNLINK_CONTEXT,
  1078. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1079. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS, "Write to disk",
  1080. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP,
  1081. NETDATA_EBPF_CHART_TYPE_STACKED, 20066,
  1082. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_VFS_WRITE_CONTEXT,
  1083. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1084. if (em->mode < MODE_ENTRY) {
  1085. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS_ERROR, "Fails to write",
  1086. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP,
  1087. NETDATA_EBPF_CHART_TYPE_STACKED, 20067,
  1088. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1089. NETDATA_SYSTEMD_VFS_WRITE_ERROR_CONTEXT,
  1090. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1091. }
  1092. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_READ_CALLS, "Read from disk",
  1093. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP,
  1094. NETDATA_EBPF_CHART_TYPE_STACKED, 20068,
  1095. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_VFS_READ_CONTEXT,
  1096. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1097. if (em->mode < MODE_ENTRY) {
  1098. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_READ_CALLS_ERROR, "Fails to read",
  1099. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP,
  1100. NETDATA_EBPF_CHART_TYPE_STACKED, 20069,
  1101. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1102. NETDATA_SYSTEMD_VFS_READ_ERROR_CONTEXT,
  1103. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1104. }
  1105. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_WRITE_BYTES, "Bytes written on disk",
  1106. EBPF_COMMON_DIMENSION_BYTES, NETDATA_VFS_CGROUP_GROUP,
  1107. NETDATA_EBPF_CHART_TYPE_STACKED, 20070,
  1108. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_VFS_WRITE_BYTES_CONTEXT,
  1109. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1110. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_READ_BYTES, "Bytes read from disk",
  1111. EBPF_COMMON_DIMENSION_BYTES, NETDATA_VFS_CGROUP_GROUP,
  1112. NETDATA_EBPF_CHART_TYPE_STACKED, 20071,
  1113. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_VFS_READ_BYTES_CONTEXT,
  1114. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1115. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_FSYNC, "Calls to <code>vfs_fsync</code>",
  1116. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP,
  1117. NETDATA_EBPF_CHART_TYPE_STACKED, 20072,
  1118. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_VFS_FSYNC_CONTEXT,
  1119. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1120. if (em->mode < MODE_ENTRY) {
  1121. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_FSYNC_CALLS_ERROR, "Sync error",
  1122. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP,
  1123. NETDATA_EBPF_CHART_TYPE_STACKED, 20073,
  1124. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_VFS_FSYNC_ERROR_CONTEXT,
  1125. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1126. }
  1127. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_OPEN, "Calls to <code>vfs_open</code>",
  1128. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP,
  1129. NETDATA_EBPF_CHART_TYPE_STACKED, 20074,
  1130. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_VFS_OPEN_CONTEXT,
  1131. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1132. if (em->mode < MODE_ENTRY) {
  1133. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_OPEN_CALLS_ERROR, "Open error",
  1134. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP,
  1135. NETDATA_EBPF_CHART_TYPE_STACKED, 20075,
  1136. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_VFS_OPEN_ERROR_CONTEXT,
  1137. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1138. }
  1139. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_CREATE, "Calls to <code>vfs_create</code>",
  1140. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP,
  1141. NETDATA_EBPF_CHART_TYPE_STACKED, 20076,
  1142. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_VFS_CREATE_CONTEXT,
  1143. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1144. if (em->mode < MODE_ENTRY) {
  1145. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_CREATE_CALLS_ERROR, "Create error",
  1146. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP,
  1147. NETDATA_EBPF_CHART_TYPE_STACKED, 20077,
  1148. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_VFS_CREATE_ERROR_CONTEXT,
  1149. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1150. }
  1151. }
  1152. /**
  1153. * Send Systemd charts
  1154. *
  1155. * Send collected data to Netdata.
  1156. *
  1157. * @param em the main collector structure
  1158. */
  1159. static void ebpf_send_systemd_vfs_charts(ebpf_module_t *em)
  1160. {
  1161. ebpf_cgroup_target_t *ect;
  1162. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_FILE_DELETED);
  1163. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1164. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1165. write_chart_dimension(ect->name, ect->publish_systemd_vfs.unlink_call);
  1166. }
  1167. }
  1168. write_end_chart();
  1169. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS);
  1170. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1171. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1172. write_chart_dimension(ect->name, ect->publish_systemd_vfs.write_call +
  1173. ect->publish_systemd_vfs.writev_call);
  1174. }
  1175. }
  1176. write_end_chart();
  1177. if (em->mode < MODE_ENTRY) {
  1178. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS_ERROR);
  1179. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1180. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1181. write_chart_dimension(ect->name, ect->publish_systemd_vfs.write_err +
  1182. ect->publish_systemd_vfs.writev_err);
  1183. }
  1184. }
  1185. write_end_chart();
  1186. }
  1187. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_READ_CALLS);
  1188. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1189. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1190. write_chart_dimension(ect->name, ect->publish_systemd_vfs.read_call +
  1191. ect->publish_systemd_vfs.readv_call);
  1192. }
  1193. }
  1194. write_end_chart();
  1195. if (em->mode < MODE_ENTRY) {
  1196. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_READ_CALLS_ERROR);
  1197. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1198. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1199. write_chart_dimension(ect->name, ect->publish_systemd_vfs.read_err +
  1200. ect->publish_systemd_vfs.readv_err);
  1201. }
  1202. }
  1203. write_end_chart();
  1204. }
  1205. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_WRITE_BYTES);
  1206. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1207. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1208. write_chart_dimension(ect->name, ect->publish_systemd_vfs.write_bytes +
  1209. ect->publish_systemd_vfs.writev_bytes);
  1210. }
  1211. }
  1212. write_end_chart();
  1213. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_READ_BYTES);
  1214. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1215. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1216. write_chart_dimension(ect->name, ect->publish_systemd_vfs.read_bytes +
  1217. ect->publish_systemd_vfs.readv_bytes);
  1218. }
  1219. }
  1220. write_end_chart();
  1221. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_FSYNC);
  1222. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1223. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1224. write_chart_dimension(ect->name, ect->publish_systemd_vfs.fsync_call);
  1225. }
  1226. }
  1227. write_end_chart();
  1228. if (em->mode < MODE_ENTRY) {
  1229. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_FSYNC_CALLS_ERROR);
  1230. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1231. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1232. write_chart_dimension(ect->name, ect->publish_systemd_vfs.fsync_err);
  1233. }
  1234. }
  1235. write_end_chart();
  1236. }
  1237. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_OPEN);
  1238. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1239. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1240. write_chart_dimension(ect->name, ect->publish_systemd_vfs.open_call);
  1241. }
  1242. }
  1243. write_end_chart();
  1244. if (em->mode < MODE_ENTRY) {
  1245. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_OPEN_CALLS_ERROR);
  1246. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1247. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1248. write_chart_dimension(ect->name, ect->publish_systemd_vfs.open_err);
  1249. }
  1250. }
  1251. write_end_chart();
  1252. }
  1253. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_CREATE);
  1254. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1255. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1256. write_chart_dimension(ect->name, ect->publish_systemd_vfs.create_call);
  1257. }
  1258. }
  1259. write_end_chart();
  1260. if (em->mode < MODE_ENTRY) {
  1261. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_CREATE_CALLS_ERROR);
  1262. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1263. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1264. write_chart_dimension(ect->name, ect->publish_systemd_vfs.create_err);
  1265. }
  1266. }
  1267. write_end_chart();
  1268. }
  1269. }
  1270. /**
  1271. * Send data to Netdata calling auxiliary functions.
  1272. *
  1273. * @param em the main collector structure
  1274. */
  1275. static void ebpf_vfs_send_cgroup_data(ebpf_module_t *em)
  1276. {
  1277. if (!ebpf_cgroup_pids)
  1278. return;
  1279. pthread_mutex_lock(&mutex_cgroup_shm);
  1280. ebpf_cgroup_target_t *ect;
  1281. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1282. ebpf_vfs_sum_cgroup_pids(&ect->publish_systemd_vfs, ect->pids);
  1283. }
  1284. int has_systemd = shm_ebpf_cgroup.header->systemd_enabled;
  1285. if (has_systemd) {
  1286. if (send_cgroup_chart) {
  1287. ebpf_create_systemd_vfs_charts(em);
  1288. }
  1289. ebpf_send_systemd_vfs_charts(em);
  1290. }
  1291. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1292. if (ect->systemd)
  1293. continue;
  1294. if (!(ect->flags & NETDATA_EBPF_CGROUP_HAS_VFS_CHART) && ect->updated) {
  1295. ebpf_create_specific_vfs_charts(ect->name, em);
  1296. ect->flags |= NETDATA_EBPF_CGROUP_HAS_VFS_CHART;
  1297. }
  1298. if (ect->flags & NETDATA_EBPF_CGROUP_HAS_VFS_CHART) {
  1299. if (ect->updated) {
  1300. ebpf_send_specific_vfs_data(ect->name, &ect->publish_systemd_vfs, em);
  1301. } else {
  1302. ebpf_obsolete_specific_vfs_charts(ect->name, em);
  1303. ect->flags &= ~NETDATA_EBPF_CGROUP_HAS_VFS_CHART;
  1304. }
  1305. }
  1306. }
  1307. pthread_mutex_unlock(&mutex_cgroup_shm);
  1308. }
  1309. /**
  1310. * Main loop for this collector.
  1311. *
  1312. * @param step the number of microseconds used with heart beat
  1313. * @param em the structure with thread information
  1314. */
  1315. static void vfs_collector(ebpf_module_t *em)
  1316. {
  1317. vfs_threads.thread = mallocz(sizeof(netdata_thread_t));
  1318. vfs_threads.start_routine = ebpf_vfs_read_hash;
  1319. netdata_thread_create(vfs_threads.thread, vfs_threads.name, NETDATA_THREAD_OPTION_DEFAULT,
  1320. ebpf_vfs_read_hash, em);
  1321. int cgroups = em->cgroup_charts;
  1322. heartbeat_t hb;
  1323. heartbeat_init(&hb);
  1324. usec_t step = em->update_every * USEC_PER_SEC;
  1325. while (!ebpf_exit_plugin) {
  1326. (void)heartbeat_next(&hb, step);
  1327. if (ebpf_exit_plugin)
  1328. break;
  1329. netdata_apps_integration_flags_t apps = em->apps_charts;
  1330. pthread_mutex_lock(&collect_data_mutex);
  1331. if (apps)
  1332. ebpf_vfs_read_apps();
  1333. if (cgroups)
  1334. read_update_vfs_cgroup();
  1335. pthread_mutex_lock(&lock);
  1336. ebpf_vfs_send_data(em);
  1337. fflush(stdout);
  1338. if (apps & NETDATA_EBPF_APPS_FLAG_CHART_CREATED)
  1339. ebpf_vfs_send_apps_data(em, apps_groups_root_target);
  1340. if (cgroups)
  1341. ebpf_vfs_send_cgroup_data(em);
  1342. pthread_mutex_unlock(&lock);
  1343. pthread_mutex_unlock(&collect_data_mutex);
  1344. }
  1345. }
  1346. /*****************************************************************
  1347. *
  1348. * FUNCTIONS TO CREATE CHARTS
  1349. *
  1350. *****************************************************************/
  1351. /**
  1352. * Create IO chart
  1353. *
  1354. * @param family the chart family
  1355. * @param name the chart name
  1356. * @param axis the axis label
  1357. * @param web the group name used to attach the chart on dashboard
  1358. * @param order the order number of the specified chart
  1359. * @param algorithm the algorithm used to make the charts.
  1360. * @param update_every value to overwrite the update frequency set by the server.
  1361. */
  1362. static void ebpf_create_io_chart(char *family, char *name, char *axis, char *web,
  1363. int order, int algorithm, int update_every)
  1364. {
  1365. printf("CHART %s.%s '' 'Bytes written and read' '%s' '%s' '' line %d %d '' 'ebpf.plugin' 'filesystem'\n",
  1366. family,
  1367. name,
  1368. axis,
  1369. web,
  1370. order,
  1371. update_every);
  1372. printf("DIMENSION %s %s %s 1 1\n",
  1373. vfs_id_names[NETDATA_KEY_PUBLISH_VFS_READ],
  1374. vfs_dimension_names[NETDATA_KEY_PUBLISH_VFS_READ],
  1375. ebpf_algorithms[algorithm]);
  1376. printf("DIMENSION %s %s %s -1 1\n",
  1377. vfs_id_names[NETDATA_KEY_PUBLISH_VFS_WRITE],
  1378. vfs_dimension_names[NETDATA_KEY_PUBLISH_VFS_WRITE],
  1379. ebpf_algorithms[algorithm]);
  1380. }
  1381. /**
  1382. * Create global charts
  1383. *
  1384. * Call ebpf_create_chart to create the charts for the collector.
  1385. *
  1386. * @param em a pointer to the structure with the default values.
  1387. */
  1388. static void ebpf_create_global_charts(ebpf_module_t *em)
  1389. {
  1390. ebpf_create_chart(NETDATA_FILESYSTEM_FAMILY,
  1391. NETDATA_VFS_FILE_CLEAN_COUNT,
  1392. "Remove files",
  1393. EBPF_COMMON_DIMENSION_CALL,
  1394. NETDATA_VFS_GROUP,
  1395. NULL,
  1396. NETDATA_EBPF_CHART_TYPE_LINE,
  1397. NETDATA_CHART_PRIO_FILESYSTEM_VFS_CLEAN,
  1398. ebpf_create_global_dimension,
  1399. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_UNLINK],
  1400. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1401. ebpf_create_chart(NETDATA_FILESYSTEM_FAMILY,
  1402. NETDATA_VFS_FILE_IO_COUNT,
  1403. "Calls to IO",
  1404. EBPF_COMMON_DIMENSION_CALL,
  1405. NETDATA_VFS_GROUP,
  1406. NULL,
  1407. NETDATA_EBPF_CHART_TYPE_LINE,
  1408. NETDATA_CHART_PRIO_FILESYSTEM_VFS_IO_COUNT,
  1409. ebpf_create_global_dimension,
  1410. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ],
  1411. 2, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1412. ebpf_create_io_chart(NETDATA_FILESYSTEM_FAMILY,
  1413. NETDATA_VFS_IO_FILE_BYTES, EBPF_COMMON_DIMENSION_BYTES,
  1414. NETDATA_VFS_GROUP,
  1415. NETDATA_CHART_PRIO_FILESYSTEM_VFS_IO_BYTES,
  1416. NETDATA_EBPF_INCREMENTAL_IDX, em->update_every);
  1417. if (em->mode < MODE_ENTRY) {
  1418. ebpf_create_chart(NETDATA_FILESYSTEM_FAMILY,
  1419. NETDATA_VFS_FILE_ERR_COUNT,
  1420. "Fails to write or read",
  1421. EBPF_COMMON_DIMENSION_CALL,
  1422. NETDATA_VFS_GROUP,
  1423. NULL,
  1424. NETDATA_EBPF_CHART_TYPE_LINE,
  1425. NETDATA_CHART_PRIO_FILESYSTEM_VFS_IO_EBYTES,
  1426. ebpf_create_global_dimension,
  1427. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ],
  1428. 2, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1429. }
  1430. ebpf_create_chart(NETDATA_FILESYSTEM_FAMILY,
  1431. NETDATA_VFS_FSYNC,
  1432. "Calls for <code>vfs_fsync</code>",
  1433. EBPF_COMMON_DIMENSION_CALL,
  1434. NETDATA_VFS_GROUP,
  1435. NULL,
  1436. NETDATA_EBPF_CHART_TYPE_LINE,
  1437. NETDATA_CHART_PRIO_FILESYSTEM_VFS_IO_FSYNC,
  1438. ebpf_create_global_dimension,
  1439. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_FSYNC],
  1440. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1441. if (em->mode < MODE_ENTRY) {
  1442. ebpf_create_chart(NETDATA_FILESYSTEM_FAMILY,
  1443. NETDATA_VFS_FSYNC_ERR,
  1444. "Fails to synchronize",
  1445. EBPF_COMMON_DIMENSION_CALL,
  1446. NETDATA_VFS_GROUP,
  1447. NULL,
  1448. NETDATA_EBPF_CHART_TYPE_LINE,
  1449. NETDATA_CHART_PRIO_FILESYSTEM_VFS_IO_EFSYNC,
  1450. ebpf_create_global_dimension,
  1451. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_FSYNC],
  1452. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1453. }
  1454. ebpf_create_chart(NETDATA_FILESYSTEM_FAMILY,
  1455. NETDATA_VFS_OPEN,
  1456. "Calls for <code>vfs_open</code>",
  1457. EBPF_COMMON_DIMENSION_CALL,
  1458. NETDATA_VFS_GROUP,
  1459. NULL,
  1460. NETDATA_EBPF_CHART_TYPE_LINE,
  1461. NETDATA_CHART_PRIO_FILESYSTEM_VFS_IO_OPEN,
  1462. ebpf_create_global_dimension,
  1463. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_OPEN],
  1464. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1465. if (em->mode < MODE_ENTRY) {
  1466. ebpf_create_chart(NETDATA_FILESYSTEM_FAMILY,
  1467. NETDATA_VFS_OPEN_ERR,
  1468. "Fails to open a file",
  1469. EBPF_COMMON_DIMENSION_CALL,
  1470. NETDATA_VFS_GROUP,
  1471. NULL,
  1472. NETDATA_EBPF_CHART_TYPE_LINE,
  1473. NETDATA_CHART_PRIO_FILESYSTEM_VFS_IO_EOPEN,
  1474. ebpf_create_global_dimension,
  1475. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_OPEN],
  1476. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1477. }
  1478. ebpf_create_chart(NETDATA_FILESYSTEM_FAMILY,
  1479. NETDATA_VFS_CREATE,
  1480. "Calls for <code>vfs_create</code>",
  1481. EBPF_COMMON_DIMENSION_CALL,
  1482. NETDATA_VFS_GROUP,
  1483. NULL,
  1484. NETDATA_EBPF_CHART_TYPE_LINE,
  1485. NETDATA_CHART_PRIO_FILESYSTEM_VFS_IO_CREATE,
  1486. ebpf_create_global_dimension,
  1487. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_CREATE],
  1488. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1489. if (em->mode < MODE_ENTRY) {
  1490. ebpf_create_chart(NETDATA_FILESYSTEM_FAMILY,
  1491. NETDATA_VFS_CREATE_ERR,
  1492. "Fails to create a file.",
  1493. EBPF_COMMON_DIMENSION_CALL,
  1494. NETDATA_VFS_GROUP,
  1495. NULL,
  1496. NETDATA_EBPF_CHART_TYPE_LINE,
  1497. NETDATA_CHART_PRIO_FILESYSTEM_VFS_IO_ECREATE,
  1498. ebpf_create_global_dimension,
  1499. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_CREATE],
  1500. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1501. }
  1502. }
  1503. /**
  1504. * Create process apps charts
  1505. *
  1506. * Call ebpf_create_chart to create the charts on apps submenu.
  1507. *
  1508. * @param em a pointer to the structure with the default values.
  1509. * @param ptr a pointer for the targets.
  1510. **/
  1511. void ebpf_vfs_create_apps_charts(struct ebpf_module *em, void *ptr)
  1512. {
  1513. struct target *root = ptr;
  1514. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_FILE_DELETED,
  1515. "Files deleted",
  1516. EBPF_COMMON_DIMENSION_CALL,
  1517. NETDATA_VFS_GROUP,
  1518. NETDATA_EBPF_CHART_TYPE_STACKED,
  1519. 20065,
  1520. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1521. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1522. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS,
  1523. "Write to disk",
  1524. EBPF_COMMON_DIMENSION_CALL,
  1525. NETDATA_VFS_GROUP,
  1526. NETDATA_EBPF_CHART_TYPE_STACKED,
  1527. 20066,
  1528. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1529. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1530. if (em->mode < MODE_ENTRY) {
  1531. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS_ERROR,
  1532. "Fails to write",
  1533. EBPF_COMMON_DIMENSION_CALL,
  1534. NETDATA_VFS_GROUP,
  1535. NETDATA_EBPF_CHART_TYPE_STACKED,
  1536. 20067,
  1537. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1538. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1539. }
  1540. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_READ_CALLS,
  1541. "Read from disk",
  1542. EBPF_COMMON_DIMENSION_CALL,
  1543. NETDATA_VFS_GROUP,
  1544. NETDATA_EBPF_CHART_TYPE_STACKED,
  1545. 20068,
  1546. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1547. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1548. if (em->mode < MODE_ENTRY) {
  1549. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_READ_CALLS_ERROR,
  1550. "Fails to read",
  1551. EBPF_COMMON_DIMENSION_CALL,
  1552. NETDATA_VFS_GROUP,
  1553. NETDATA_EBPF_CHART_TYPE_STACKED,
  1554. 20069,
  1555. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1556. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1557. }
  1558. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_WRITE_BYTES,
  1559. "Bytes written on disk", EBPF_COMMON_DIMENSION_BYTES,
  1560. NETDATA_VFS_GROUP,
  1561. NETDATA_EBPF_CHART_TYPE_STACKED,
  1562. 20070,
  1563. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1564. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1565. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_READ_BYTES,
  1566. "Bytes read from disk", EBPF_COMMON_DIMENSION_BYTES,
  1567. NETDATA_VFS_GROUP,
  1568. NETDATA_EBPF_CHART_TYPE_STACKED,
  1569. 20071,
  1570. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1571. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1572. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_FSYNC,
  1573. "Calls for <code>vfs_fsync</code>", EBPF_COMMON_DIMENSION_CALL,
  1574. NETDATA_VFS_GROUP,
  1575. NETDATA_EBPF_CHART_TYPE_STACKED,
  1576. 20072,
  1577. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1578. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1579. if (em->mode < MODE_ENTRY) {
  1580. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_FSYNC_CALLS_ERROR,
  1581. "Sync error",
  1582. EBPF_COMMON_DIMENSION_CALL,
  1583. NETDATA_VFS_GROUP,
  1584. NETDATA_EBPF_CHART_TYPE_STACKED,
  1585. 20073,
  1586. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1587. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1588. }
  1589. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_OPEN,
  1590. "Calls for <code>vfs_open</code>", EBPF_COMMON_DIMENSION_CALL,
  1591. NETDATA_VFS_GROUP,
  1592. NETDATA_EBPF_CHART_TYPE_STACKED,
  1593. 20074,
  1594. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1595. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1596. if (em->mode < MODE_ENTRY) {
  1597. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_OPEN_CALLS_ERROR,
  1598. "Open error",
  1599. EBPF_COMMON_DIMENSION_CALL,
  1600. NETDATA_VFS_GROUP,
  1601. NETDATA_EBPF_CHART_TYPE_STACKED,
  1602. 20075,
  1603. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1604. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1605. }
  1606. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_CREATE,
  1607. "Calls for <code>vfs_create</code>", EBPF_COMMON_DIMENSION_CALL,
  1608. NETDATA_VFS_GROUP,
  1609. NETDATA_EBPF_CHART_TYPE_STACKED,
  1610. 20076,
  1611. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1612. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1613. if (em->mode < MODE_ENTRY) {
  1614. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_CREATE_CALLS_ERROR,
  1615. "Create error",
  1616. EBPF_COMMON_DIMENSION_CALL,
  1617. NETDATA_VFS_GROUP,
  1618. NETDATA_EBPF_CHART_TYPE_STACKED,
  1619. 20077,
  1620. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1621. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1622. }
  1623. em->apps_charts |= NETDATA_EBPF_APPS_FLAG_CHART_CREATED;
  1624. }
  1625. /*****************************************************************
  1626. *
  1627. * FUNCTIONS TO START THREAD
  1628. *
  1629. *****************************************************************/
  1630. /**
  1631. * Allocate vectors used with this thread.
  1632. * We are not testing the return, because callocz does this and shutdown the software
  1633. * case it was not possible to allocate.
  1634. *
  1635. * @param apps is apps enabled?
  1636. */
  1637. static void ebpf_vfs_allocate_global_vectors(int apps)
  1638. {
  1639. memset(vfs_aggregated_data, 0, sizeof(vfs_aggregated_data));
  1640. memset(vfs_publish_aggregated, 0, sizeof(vfs_publish_aggregated));
  1641. vfs_hash_values = callocz(ebpf_nprocs, sizeof(netdata_idx_t));
  1642. vfs_vector = callocz(ebpf_nprocs, sizeof(netdata_publish_vfs_t));
  1643. if (apps)
  1644. vfs_pid = callocz((size_t)pid_max, sizeof(netdata_publish_vfs_t *));
  1645. }
  1646. /*****************************************************************
  1647. *
  1648. * EBPF VFS THREAD
  1649. *
  1650. *****************************************************************/
  1651. /*
  1652. * Load BPF
  1653. *
  1654. * Load BPF files.
  1655. *
  1656. * @param em the structure with configuration
  1657. */
  1658. static int ebpf_vfs_load_bpf(ebpf_module_t *em)
  1659. {
  1660. int ret = 0;
  1661. ebpf_adjust_apps_cgroup(em, em->targets[NETDATA_EBPF_VFS_WRITE].mode);
  1662. if (em->load & EBPF_LOAD_LEGACY) {
  1663. em->probe_links = ebpf_load_program(ebpf_plugin_dir, em, running_on_kernel, isrh, &em->objects);
  1664. if (!em->probe_links) {
  1665. ret = -1;
  1666. }
  1667. }
  1668. #ifdef LIBBPF_MAJOR_VERSION
  1669. else {
  1670. bpf_obj = vfs_bpf__open();
  1671. if (!bpf_obj)
  1672. ret = -1;
  1673. else
  1674. ret = ebpf_vfs_load_and_attach(bpf_obj, em);
  1675. }
  1676. #endif
  1677. return ret;
  1678. }
  1679. /**
  1680. * Process thread
  1681. *
  1682. * Thread used to generate process charts.
  1683. *
  1684. * @param ptr a pointer to `struct ebpf_module`
  1685. *
  1686. * @return It always return NULL
  1687. */
  1688. void *ebpf_vfs_thread(void *ptr)
  1689. {
  1690. netdata_thread_cleanup_push(ebpf_vfs_exit, ptr);
  1691. ebpf_module_t *em = (ebpf_module_t *)ptr;
  1692. em->maps = vfs_maps;
  1693. ebpf_update_pid_table(&vfs_maps[NETDATA_VFS_PID], em);
  1694. ebpf_vfs_allocate_global_vectors(em->apps_charts);
  1695. #ifdef LIBBPF_MAJOR_VERSION
  1696. ebpf_adjust_thread_load(em, default_btf);
  1697. #endif
  1698. if (ebpf_vfs_load_bpf(em)) {
  1699. em->thread->enabled = NETDATA_THREAD_EBPF_STOPPED;
  1700. goto endvfs;
  1701. }
  1702. int algorithms[NETDATA_KEY_PUBLISH_VFS_END] = {
  1703. NETDATA_EBPF_INCREMENTAL_IDX, NETDATA_EBPF_INCREMENTAL_IDX,NETDATA_EBPF_INCREMENTAL_IDX,
  1704. NETDATA_EBPF_INCREMENTAL_IDX, NETDATA_EBPF_INCREMENTAL_IDX,NETDATA_EBPF_INCREMENTAL_IDX
  1705. };
  1706. ebpf_global_labels(vfs_aggregated_data, vfs_publish_aggregated, vfs_dimension_names,
  1707. vfs_id_names, algorithms, NETDATA_KEY_PUBLISH_VFS_END);
  1708. pthread_mutex_lock(&lock);
  1709. ebpf_create_global_charts(em);
  1710. ebpf_update_stats(&plugin_statistics, em);
  1711. pthread_mutex_unlock(&lock);
  1712. vfs_collector(em);
  1713. endvfs:
  1714. ebpf_update_disabled_plugin_stats(em);
  1715. netdata_thread_cleanup_pop(1);
  1716. return NULL;
  1717. }