tetragon: Add support to count lost events

Signed-off-by: Jiri Olsa <[email protected]>
cilium · Jul 3, 2023 · 0299180 · 0299180
1 parent 480b399
commit 0299180
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 2 deletions.
diff --git a/bpf/lib/bpf_event.h b/bpf/lib/bpf_event.h
@@ -16,10 +16,34 @@ struct {
 	__type(value, struct event);
 } tcpmon_map SEC(".maps");
 
+struct {
+	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
+	__uint(max_entries, 255);
+	__type(key, __u32);
+	__type(value, __u64);
+} lost_event SEC(".maps");
+
+static inline __attribute__((always_inline)) void
+inc_lost_event(void *ctx, __u8 op)
+{
+	__u32 idx = op;
+	__u64 *lost;
+
+	lost = map_lookup_elem(&lost_event, &idx);
+	if (lost)
+		(*lost)++;
+}
+
+#define ENOSPC 28
+
 static inline __attribute__((always_inline)) void
 send_event(void *ctx, void *data, size_t total, __u8 op)
 {
-	perf_event_output(ctx, &tcpmon_map, BPF_F_CURRENT_CPU, data, total);
+	long err;
+
+	err = perf_event_output(ctx, &tcpmon_map, BPF_F_CURRENT_CPU, data, total);
+	if (err == -ENOSPC)
+		inc_lost_event(ctx, op);
 }
 
 #endif // __HUBBLE_MSG_
diff --git a/pkg/sensors/base/base.go b/pkg/sensors/base/base.go
@@ -37,7 +37,8 @@ var (
 	)
 
 	/* Event Ring map */
-	TCPMonMap = program.MapBuilder("tcpmon_map", Execve)
+	TCPMonMap    = program.MapBuilder("tcpmon_map", Execve)
+	LostEventMap = program.MapBuilder("lost_event", Execve)
 	/* Networking and Process Monitoring maps */
 	ExecveMap          = program.MapBuilder("execve_map", Execve)
 	ExecveTailCallsMap = program.MapBuilderPin("execve_calls", "execve_calls", Execve)
@@ -80,6 +81,7 @@ func GetDefaultMaps() []*program.Map {
 		ExecveTailCallsMap,
 		NamesMap,
 		TCPMonMap,
+		LostEventMap,
 		TetragonConfMap,
 	}
 	return maps