ebpf

Documentation

Index

• Variables
• type BTFLoader
  • func NewBTFLoader(cfg *config.EBPFConfig) *BTFLoader
  • func (l *BTFLoader) LoadSpec(ctx context.Context) (*btf.Spec, string, error)
• type Event
• type HotPathSink
• type LifecycleEvent
• type Manager
  • func NewManager(stateDir string, cfg *config.EBPFConfig) (Manager, error)
• type Profiler
  • func NewProfiler(cfg *config.EBPFConfig, sink HotPathSink) *Profiler
  • func (p *Profiler) Flush()
  • func (p *Profiler) Record(path string)
  • func (p *Profiler) Run(ctx context.Context)
  • func (p *Profiler) Snapshot() map[string]float64

Variables

var ErrUnsupported = errors.New("eBPF monitoring is only supported on Linux kernels >= 4.18")

ErrUnsupported is returned when the current platform cannot host eBPF programs

Types

type BTFLoader

type BTFLoader struct {
	// contains filtered or unexported fields
}

BTFLoader discovers or downloads BTF specs for CO-RE relocations.

func NewBTFLoader

func NewBTFLoader(cfg *config.EBPFConfig) *BTFLoader

NewBTFLoader constructs a loader based on CLI/env configuration.

func (*BTFLoader) LoadSpec

func (l *BTFLoader) LoadSpec(ctx context.Context) (*btf.Spec, string, error)

LoadSpec returns a usable BTF spec and the source path it originated from.

type Event

type Event struct {
	PID       uint32
	Path      string
	Bytes     uint64
	Timestamp time.Time
}

Event represents a captured syscall write targeting a given path

type HotPathSink

type HotPathSink interface {
	ApplyHotPathHints(map[string]float64) error
}

HotPathSink consumes adaptive profiler hints to refine kernel filters

type LifecycleEvent

type LifecycleEvent struct {
	Runtime     string
	Namespace   string
	ContainerID string
	PID         uint32
	State       string
	Timestamp   time.Time
}

LifecycleEvent represents a container lifecycle transition (create/start/stop)

type Manager

type Manager interface {
	Start(ctx context.Context) error
	Close() error
	Events() <-chan Event
	LifecycleEvents() <-chan LifecycleEvent
	ApplyHotPathHints(map[string]float64) error
}

Manager exposes kernel-level monitoring primitives regardless of platform

func NewManager

func NewManager(stateDir string, cfg *config.EBPFConfig) (Manager, error)

NewManager loads a compiled eBPF program and prepares syscall/lifecycle probes.

type Profiler

type Profiler struct {
	// contains filtered or unexported fields
}

Profiler performs lightweight EMA calculations to predict frequently modified paths

func NewProfiler

func NewProfiler(cfg *config.EBPFConfig, sink HotPathSink) *Profiler

NewProfiler builds a profiler using EBPFConfig settings

func (*Profiler) Flush

func (p *Profiler) Flush()

Flush forces an immediate EMA update (used for tests and manual tuning)

func (*Profiler) Record

func (p *Profiler) Record(path string)

Record increments sample counts for a path

func (*Profiler) Run

func (p *Profiler) Run(ctx context.Context)

Run begins periodic prediction loop until ctx is cancelled

func (*Profiler) Snapshot

func (p *Profiler) Snapshot() map[string]float64

Snapshot returns a copy of current EMA map (for testing/diagnostics)