Integration between eBPF and Apps (#9178)

* ebpf_apps: Create files to do integration

* ebpf_apps: move functions from apps to ebpf part 1

* ebpf_apps: move functions from apps to ebpf part 2

* ebpf_apps: Functions to read apps_groups.conf

* ebpf_apps: reset structures

* ebpf_apps: Verify user running plugin

* ebpf_apps: Adjust structures used for eBPF.plugin

* rebase

* ebpf_apps: Move ebpf submenu near apps submenu

* ebpf_apps: Brings structures from kernel-collector repository4

* ebpf_apps: Set definitions for the new chart names

* ebpf_apps: bring new functions to read data from kernel ring

* ebpf_apps: New variable to store PID information on process thread

* ebpf_apps: It brings PID variable to socket

* ebpf_apps: Chart creation

* ebpf_apps: New probe

* ebpf_apps: Fix order

* ebpf_apps: Clean targets

* ebpf_apps: Necessary changes to avoid parse proc

* rebase

* ebpf_apps: Fix key inside collect_data_for_all_processes to remove infinite loop

* ebpf_apps: Bring variables to read data from hash table

* ebpf_apps: Fix coverity warnings

* ebpf_apps: Fix the missing allocation for all_pids and another small adjusts

* ebpf_apps: Postpone thread creation to fill targets

* ebpf_apps: Add comments while functions were tested

* ebpf_apps: Fix LGTM warnings

* ebpf_apps: Clean allocated structure with raw data

* ebpf_apps: Bring missing functions to calculate apps charts for process

* ebpf_apps: Rename a function and update apps_groups.conf

* ebpf_apps: Copy logic for chart creation to sockets

* ebpf_apps: Remove unecessary variable

* Update chart creating

* Remove Users and User Groups targets

* ebpf_apps: missing argument

* ebpf_apps: Fix LGTM https://github.com/netdata/netdata/pull/9178#issuecomment-638253538 error

* Synchronize getting and sending data

* eb^C_apps: Remove error messages adding read of proc file

* ebpf_apps: Missing function

* ebpf_apps: Move socket chart creation and change necessary functions
to read cmdline

* ebpf_apps: Bring missing loop to reset variable

* ebpf_apps: Remove unecessary sleep

* ebpf_apps: Fix return and allocation to allow the
apps integration

* ebpf_apps: create structure to set apps dimension

* ebpf_apps: create structure to set apps dimension for socket

* ebpf_apps: Fix wrong family for process

* ebpf_apps: Enable apps by default

* Functions to enable charts for apps

* Fix small bugs

* ebpf_apps: Fix missing root_pid

* Fix negative output on charts

* ebpf_apps: Remove debug messages from process

* ebpf_apps: Fix socket lock scheme

* ebpf_apps: Small fixes

* ebpf_apps; Remove unecessary function call and header

* ebpf_apps: Enable apps by default

* remove wrong files

* ebpf_apps: update cheksum

* Update dashboard.info bringing missing parameters for charts that do integration with ebpf

* Fix a bug

* ebpf_apps: Fix open of proc files that are not more present

* ebpf_apps:Fix synchronization problems

* ebpf_apps: Remove dupplication that was killing socket charts

* ebpf_apps: Fix codacy warnings

* ebpf_apps: Fix process read from memory

* ebpf_apps: Remove unecessary variable from code

* ebpf_apps: Fix wrong variable usage

* ebpf_apps: complete separation between global and apps charts

* Fix missing check and a wrong check

* ebpf_apps: Comment unnecessary code copied from apps_plugin.c

* ebpf_apps: Restart ebpf when number of monitored PIDs is smaller than 0.7

* ebpf_apps: Fix coverity scan error

* ebpf_release: Update release version

* ebpf_apps: Remove unecessary test

* ebpf_apps: Remove unecessary error message

* ebpf_apps: Clean probes during the startup

* ebpf_apps: Bring additional variables to monitor chart plot

* ebpf_apps: Missing chart when entry mode is enabled

* ebpf_apps: Do synchronization between apps.plugin and ebpf.plugin dimension

* ebpf_apps: socket synchronization

* ebpf_apps: fix problems with task_close

* ebpf_apps: Brings title to charts

* ebpf_apps: restore to fix errors

* ebpf_apps: Remove hard code update every

* ebpf_apps: rename variables

* ebpf_apps: Bring title for the charts

* ebpf_apps: Remove unecessary line

* ebpf_apps: bring new release to PR

* ebpf_apps: Fix constant value when a function is not used for a process

* ebpf_apps: This fixes a possible memory leak

* ebpf_apps: move delete function to bring back synchronization between charts

* Change chart type

* Fix for exited pids

Co-authored-by: Vladimir Kobal <vlad@prokk.net>

2 files changed, 7 insertions, 0 deletions

diff --git a/libnetdata/ebpf/ebpf.c b/libnetdata/ebpf/ebpf.c
index 7bce4c1ee0..df1ff7da4b 100644
--- a/libnetdata/ebpf/ebpf.c
+++ b/libnetdata/ebpf/ebpf.c
@@ -225,6 +225,12 @@ int ebpf_load_libraries(ebpf_functions_t *ef, char *libbase, char *pluginsdir)
         return -1;
     }
 
+    ef->bpf_map_get_next_key = dlsym(libnetdata, "bpf_map_get_next_key");
+    if ((err = dlerror()) != NULL) {
+        error("Cannot find bpf_map_delete_elem: %s", err);
+        return -1;
+    }
+
     return 0;
 }
 
diff --git a/libnetdata/ebpf/ebpf.h b/libnetdata/ebpf/ebpf.h
index 2ef33dee81..6e01786c85 100644
--- a/libnetdata/ebpf/ebpf.h
+++ b/libnetdata/ebpf/ebpf.h
@@ -58,6 +58,7 @@ typedef struct ebpf_functions {
     //Libbpf (It is necessary to have at least kernel 4.10)
     int (*bpf_map_lookup_elem)(int, const void *, void *);
     int (*bpf_map_delete_elem)(int fd, const void *key);
+    int (*bpf_map_get_next_key)(int fd, const void *key, void *next_key);
 
     int *map_fd;