Modify PID monitoring (ebpf.plugin) (#13397)

2 files changed, 111 insertions, 18 deletions

diff --git a/libnetdata/ebpf/ebpf.c b/libnetdata/ebpf/ebpf.c
index c48f2f24ec..268515a98d 100644
--- a/libnetdata/ebpf/ebpf.c
+++ b/libnetdata/ebpf/ebpf.c
@@ -279,7 +279,8 @@ static char *ebpf_select_kernel_name(uint32_t selector)
 {
     static char *kernel_names[] = { NETDATA_IDX_STR_V3_10, NETDATA_IDX_STR_V4_14, NETDATA_IDX_STR_V4_16,
                                     NETDATA_IDX_STR_V4_18, NETDATA_IDX_STR_V5_4,  NETDATA_IDX_STR_V5_10,
-                                    NETDATA_IDX_STR_V5_11, NETDATA_IDX_STR_V5_15, NETDATA_IDX_STR_V5_16
+                                    NETDATA_IDX_STR_V5_11, NETDATA_IDX_STR_V5_14, NETDATA_IDX_STR_V5_15,
+                                    NETDATA_IDX_STR_V5_16
                                   };
 
     return kernel_names[selector];
@@ -298,7 +299,9 @@ static char *ebpf_select_kernel_name(uint32_t selector)
 static int ebpf_select_max_index(int is_rhf, uint32_t kver)
 {
     if (is_rhf > 0) { // Is Red Hat family
-        if (kver >= NETDATA_EBPF_KERNEL_4_11)
+        if (kver >= NETDATA_EBPF_KERNEL_5_14)
+            return NETDATA_IDX_V5_14;
+        else if (kver >= NETDATA_EBPF_KERNEL_4_11)
             return NETDATA_IDX_V4_18;
     } else { // Kernels from kernel.org
         if (kver >= NETDATA_EBPF_KERNEL_5_16)
@@ -334,6 +337,9 @@ static uint32_t ebpf_select_index(uint32_t kernels, int is_rhf, uint32_t kver)
     uint32_t start = ebpf_select_max_index(is_rhf, kver);
     uint32_t idx;
 
+    if (is_rhf == -1)
+        kernels &= ~NETDATA_V5_14;
+
     for (idx = start; idx; idx--) {
         if (kernels & 1 << idx)
             break;
@@ -465,24 +471,40 @@ void ebpf_update_pid_table(ebpf_local_maps_t *pid, ebpf_module_t *em)
  */
 void ebpf_update_map_size(struct bpf_map *map, ebpf_local_maps_t *lmap, ebpf_module_t *em, const char *map_name)
 {
+    uint32_t define_size = 0;
     uint32_t apps_type = NETDATA_EBPF_MAP_PID | NETDATA_EBPF_MAP_RESIZABLE;
     if (lmap->user_input && lmap->user_input != lmap->internal_input) {
+        define_size = lmap->internal_input;
 #ifdef NETDATA_INTERNAL_CHECKS
         info("Changing map %s from size %u to %u ", map_name, lmap->internal_input, lmap->user_input);
 #endif
-#ifdef LIBBPF_MAJOR_VERSION
-        bpf_map__set_max_entries(map, lmap->user_input);
-#else
-        bpf_map__resize(map, lmap->user_input);
-#endif
     } else if (((lmap->type & apps_type) == apps_type) && (!em->apps_charts) && (!em->cgroup_charts)) {
         lmap->user_input = ND_EBPF_DEFAULT_MIN_PID;
+    } else if (((em->apps_charts) || (em->cgroup_charts)) && (em->apps_level != NETDATA_APPS_NOT_SET)) {
+        switch (em->apps_level) {
+            case NETDATA_APPS_LEVEL_ALL: {
+                define_size = lmap->user_input;
+                break;
+            }
+            case NETDATA_APPS_LEVEL_PARENT: {
+                define_size = ND_EBPF_DEFAULT_PID_SIZE / 2;
+                break;
+            }
+            case NETDATA_APPS_LEVEL_REAL_PARENT:
+            default: {
+                define_size = ND_EBPF_DEFAULT_PID_SIZE / 3;
+            }
+        }
+    }
+
+    if (!define_size)
+        return;
+
 #ifdef LIBBPF_MAJOR_VERSION
-        bpf_map__set_max_entries(map, lmap->user_input);
+    bpf_map__set_max_entries(map, define_size);
 #else
-        bpf_map__resize(map, lmap->user_input);
+    bpf_map__resize(map, define_size);
 #endif
-    }
 }
 
 /**
@@ -607,11 +629,18 @@ static void ebpf_update_maps(ebpf_module_t *em, struct bpf_object *obj)
  */
 void ebpf_update_controller(int fd, ebpf_module_t *em)
 {
-    uint32_t key = NETDATA_CONTROLLER_APPS_ENABLED;
-    uint32_t value = (em->apps_charts & NETDATA_EBPF_APPS_FLAG_YES) | em->cgroup_charts;
-    int ret = bpf_map_update_elem(fd, &key, &value, 0);
-    if (ret)
-        error("Add key(%u) for controller table failed.", key);
+    uint32_t values[NETDATA_CONTROLLER_END] = {
+        (em->apps_charts & NETDATA_EBPF_APPS_FLAG_YES) | em->cgroup_charts,
+        em->apps_level
+    };
+    uint32_t key;
+    uint32_t end = (em->apps_level != NETDATA_APPS_NOT_SET) ? NETDATA_CONTROLLER_END : NETDATA_CONTROLLER_APPS_LEVEL;
+
+    for (key = NETDATA_CONTROLLER_APPS_ENABLED; key < end; key++) {
+        int ret = bpf_map_update_elem(fd, &key, &values[key], 0);
+        if (ret)
+            error("Add key(%u) for controller table failed.", key);
+    }
 }
 
 /**
@@ -806,6 +835,44 @@ static char *ebpf_convert_load_mode_to_string(netdata_ebpf_load_mode_t mode)
 }
 
 /**
+ * Convert collect pid to string
+ *
+ * @param level value that will select the string
+ *
+ * @return It returns the string associated to level.
+ */
+static char *ebpf_convert_collect_pid_to_string(netdata_apps_level_t level)
+{
+    if (level == NETDATA_APPS_LEVEL_REAL_PARENT)
+        return EBPF_CFG_PID_REAL_PARENT;
+    else if (level == NETDATA_APPS_LEVEL_PARENT)
+        return EBPF_CFG_PID_PARENT;
+    else if (level == NETDATA_APPS_LEVEL_ALL)
+        return EBPF_CFG_PID_ALL;
+
+    return EBPF_CFG_PID_ALL;
+}
+
+/**
+ * Convert string to apps level
+ *
+ * @param str the argument read from config files
+ *
+ * @return it returns the level associated to the string or default when it is a wrong value
+ */
+netdata_apps_level_t ebpf_convert_string_to_apps_level(char *str)
+{
+    if (!strcasecmp(str, EBPF_CFG_PID_REAL_PARENT))
+        return NETDATA_APPS_LEVEL_REAL_PARENT;
+    else if (!strcasecmp(str, EBPF_CFG_PID_PARENT))
+        return NETDATA_APPS_LEVEL_PARENT;
+    else if (!strcasecmp(str, EBPF_CFG_PID_ALL))
+        return NETDATA_APPS_LEVEL_ALL;
+
+    return NETDATA_APPS_NOT_SET;
+}
+
+/**
  *  CO-RE type
  *
  *  Select the preferential type of CO-RE
@@ -984,6 +1051,10 @@ void ebpf_update_module_using_config(ebpf_module_t *modules)
     value = appconfig_get(modules->cfg, EBPF_GLOBAL_SECTION, EBPF_CFG_CORE_ATTACH, EBPF_CFG_ATTACH_TRAMPOLINE);
     netdata_ebpf_program_loaded_t fill_lm = ebpf_convert_core_type(value, modules->mode);
     ebpf_update_target_with_conf(modules, fill_lm);
+
+    value = ebpf_convert_collect_pid_to_string(modules->apps_level);
+    value = appconfig_get(modules->cfg, EBPF_GLOBAL_SECTION, EBPF_CFG_COLLECT_PID, value);
+    modules->apps_level =  ebpf_convert_string_to_apps_level(value);
 }
 
 /**
@@ -1282,4 +1353,5 @@ void ebpf_select_host_prefix(char *output, size_t length, char *syscall, int kve
         char *prefix = (arch == 32) ? "__ia32" : "__x64";
         snprintfz(output, length, "%s_sys_%s", prefix, syscall);
     }
-}
\ No newline at end of file
+}
+
diff --git a/libnetdata/ebpf/ebpf.h b/libnetdata/ebpf/ebpf.h
index 55b68a51e9..61006f9478 100644
--- a/libnetdata/ebpf/ebpf.h
+++ b/libnetdata/ebpf/ebpf.h
@@ -26,6 +26,11 @@
 #define EBPF_CFG_CORE_PROGRAM "CO-RE"
 #define EBPF_CFG_LEGACY_PROGRAM "legacy"
 
+#define EBPF_CFG_COLLECT_PID "collect pid"
+#define EBPF_CFG_PID_REAL_PARENT "real parent"
+#define EBPF_CFG_PID_PARENT "parent"
+#define EBPF_CFG_PID_ALL "all"
+
 #define EBPF_CFG_CORE_ATTACH "ebpf co-re tracing"
 #define EBPF_CFG_ATTACH_TRAMPOLINE "trampoline"
 #define EBPF_CFG_ATTACH_TRACEPOINT "tracepoint"
@@ -76,6 +81,7 @@ enum netdata_ebpf_kernel_versions {
     NETDATA_EBPF_KERNEL_5_0  = 327680,  //  327680 = 5 * 65536 +  0 * 256
     NETDATA_EBPF_KERNEL_5_10 = 330240,  //  330240 = 5 * 65536 + 10 * 256
     NETDATA_EBPF_KERNEL_5_11 = 330496,  //  330240 = 5 * 65536 + 11 * 256
+    NETDATA_EBPF_KERNEL_5_14 = 331264,  //  331264 = 5 * 65536 + 14 * 256
     NETDATA_EBPF_KERNEL_5_15 = 331520,  //  331520 = 5 * 65536 + 15 * 256
     NETDATA_EBPF_KERNEL_5_16 = 331776   //  331776 = 5 * 65536 + 16 * 256
 };
@@ -88,8 +94,9 @@ enum netdata_kernel_flag {
     NETDATA_V5_4  = 1 << 4,
     NETDATA_V5_10 = 1 << 5,
     NETDATA_V5_11 = 1 << 6,
-    NETDATA_V5_15 = 1 << 7,
-    NETDATA_V5_16 = 1 << 8
+    NETDATA_V5_14 = 1 << 7,
+    NETDATA_V5_15 = 1 << 8,
+    NETDATA_V5_16 = 1 << 9
 };
 
 enum netdata_kernel_idx {
@@ -100,6 +107,7 @@ enum netdata_kernel_idx {
     NETDATA_IDX_V5_4 ,
     NETDATA_IDX_V5_10,
     NETDATA_IDX_V5_11,
+    NETDATA_IDX_V5_14,
     NETDATA_IDX_V5_15,
     NETDATA_IDX_V5_16
 };
@@ -111,6 +119,7 @@ enum netdata_kernel_idx {
 #define NETDATA_IDX_STR_V5_4  "5.4"
 #define NETDATA_IDX_STR_V5_10 "5.10"
 #define NETDATA_IDX_STR_V5_11 "5.11"
+#define NETDATA_IDX_STR_V5_14 "5.14"
 #define NETDATA_IDX_STR_V5_15 "5.15"
 #define NETDATA_IDX_STR_V5_16 "5.16"
 
@@ -161,10 +170,21 @@ enum netdata_ebpf_map_type {
 
 enum netdata_controller {
     NETDATA_CONTROLLER_APPS_ENABLED,
+    NETDATA_CONTROLLER_APPS_LEVEL,
 
     NETDATA_CONTROLLER_END
 };
 
+// Control how Netdata will monitor PIDs (apps and cgroups)
+typedef enum netdata_apps_level {
+    NETDATA_APPS_LEVEL_REAL_PARENT,
+    NETDATA_APPS_LEVEL_PARENT,
+    NETDATA_APPS_LEVEL_ALL,
+
+    // Present only in user ring
+    NETDATA_APPS_NOT_SET
+} netdata_apps_level_t;
+
 typedef struct ebpf_local_maps {
     char *name;
     uint32_t internal_input;
@@ -227,6 +247,7 @@ typedef struct ebpf_module {
     int update_every;
     int global_charts;
     netdata_apps_integration_flags_t apps_charts;
+    netdata_apps_level_t apps_level;
     int cgroup_charts;
     netdata_run_mode_t mode;
     uint32_t thread_id;