eBPF Functions (enable/disable threads) (#15214)

2 files changed, 50 insertions, 25 deletions

diff --git a/libnetdata/ebpf/ebpf.c b/libnetdata/ebpf/ebpf.c
index ed7aa9a4c9..6793f403a9 100644
--- a/libnetdata/ebpf/ebpf.c
+++ b/libnetdata/ebpf/ebpf.c
@@ -391,9 +391,10 @@ static void ebpf_mount_name(char *out, size_t len, char *path, uint32_t kver, co
  * Count the information from targets.
  *
  * @param report  the output structure
- * @param targets  vector with information about the eBPF plugin.
+ * @param targets vector with information about the eBPF plugin.
+ * @param value    factor used to update calculation
  */
-static void ebpf_stats_targets(ebpf_plugin_stats_t *report, netdata_ebpf_targets_t *targets)
+static void ebpf_stats_targets(ebpf_plugin_stats_t *report, netdata_ebpf_targets_t *targets, int value)
 {
     if (!targets) {
         report->probes = report->tracepoints = report->trampolines = 0;
@@ -404,19 +405,19 @@ static void ebpf_stats_targets(ebpf_plugin_stats_t *report, netdata_ebpf_targets
     while (targets[i].name) {
         switch (targets[i].mode) {
             case EBPF_LOAD_PROBE: {
-                report->probes++;
+                report->probes += value;
                 break;
             }
             case EBPF_LOAD_RETPROBE: {
-                report->retprobes++;
+                report->retprobes += value;
                 break;
             }
             case EBPF_LOAD_TRACEPOINT: {
-                report->tracepoints++;
+                report->tracepoints += value;
                 break;
             }
             case EBPF_LOAD_TRAMPOLINE: {
-                report->trampolines++;
+                report->trampolines += value;
                 break;
             }
         }
@@ -437,27 +438,30 @@ static void ebpf_stats_targets(ebpf_plugin_stats_t *report, netdata_ebpf_targets
  */
 void ebpf_update_stats(ebpf_plugin_stats_t *report, ebpf_module_t *em)
 {
-    report->threads++;
+    int value;
 
     // It is not necessary to report more information.
-    if (em->enabled != NETDATA_THREAD_EBPF_RUNNING)
-        return;
+    if (em->enabled > NETDATA_THREAD_EBPF_FUNCTION_RUNNING)
+        value = -1;
+    else
+        value = 1;
 
-    report->running++;
+    report->threads += value;
+    report->running += value;
 
     // In theory the `else if` is useless, because when this function is called, the module should not stay in
     // EBPF_LOAD_PLAY_DICE. We have this additional condition to detect errors from developers.
     if (em->load & EBPF_LOAD_LEGACY)
-        report->legacy++;
+        report->legacy += value;
     else if (em->load & EBPF_LOAD_CORE)
-        report->core++;
+        report->core += value;
 
     if (em->maps_per_core)
-        report->hash_percpu++;
+        report->hash_percpu += value;
     else
-        report->hash_unique++;
+        report->hash_unique += value;
 
-    ebpf_stats_targets(report, em->targets);
+    ebpf_stats_targets(report, em->targets, value);
 }
 
 /**
@@ -528,8 +532,11 @@ void ebpf_update_kernel_memory(ebpf_plugin_stats_t *report, ebpf_local_maps_t *m
  *
  * @param report  the output structure
  * @param map     pointer to a map. Last map must fish with name = NULL
+ * @param action  should plugin add or remove values from amount.
  */
-void ebpf_update_kernel_memory_with_vector(ebpf_plugin_stats_t *report, ebpf_local_maps_t *maps)
+void ebpf_update_kernel_memory_with_vector(ebpf_plugin_stats_t *report,
+                                           ebpf_local_maps_t *maps,
+                                           ebpf_stats_action_t action)
 {
     if (!maps)
         return;
@@ -541,7 +548,7 @@ void ebpf_update_kernel_memory_with_vector(ebpf_plugin_stats_t *report, ebpf_loc
         if (fd == ND_EBPF_MAP_FD_NOT_INITIALIZED)
             continue;
 
-        ebpf_update_kernel_memory(report, map, EBPF_ACTION_STAT_ADD);
+        ebpf_update_kernel_memory(report, map, action);
     }
 }
 
@@ -1238,6 +1245,9 @@ void ebpf_update_module_using_config(ebpf_module_t *modules, netdata_ebpf_load_m
     modules->pid_map_size = (uint32_t)appconfig_get_number(modules->cfg, EBPF_GLOBAL_SECTION, EBPF_CFG_PID_SIZE,
                                                            modules->pid_map_size);
 
+    modules->lifetime = (uint32_t) appconfig_get_number(modules->cfg, EBPF_GLOBAL_SECTION,
+                                                        EBPF_CFG_LIFETIME, EBPF_DEFAULT_LIFETIME);
+
     char *value = ebpf_convert_load_mode_to_string(modules->load & NETDATA_EBPF_LOAD_METHODS);
     char *type_format = appconfig_get(modules->cfg, EBPF_GLOBAL_SECTION, EBPF_CFG_TYPE_FORMAT, value);
     netdata_ebpf_load_mode_t load = epbf_convert_string_to_load_mode(type_format);
@@ -1258,7 +1268,7 @@ void ebpf_update_module_using_config(ebpf_module_t *modules, netdata_ebpf_load_m
         modules->maps_per_core = CONFIG_BOOLEAN_NO;
 
 #ifdef NETDATA_DEV_MODE
-    netdata_log_info("The thread %s was configured with: mode = %s; update every = %d; apps = %s; cgroup = %s; ebpf type format = %s; ebpf co-re tracing = %s; collect pid = %s; maps per core = %s",
+    netdata_log_info("The thread %s was configured with: mode = %s; update every = %d; apps = %s; cgroup = %s; ebpf type format = %s; ebpf co-re tracing = %s; collect pid = %s; maps per core = %s, lifetime=%u",
          modules->thread_name,
          load_mode,
          modules->update_every,
@@ -1267,7 +1277,8 @@ void ebpf_update_module_using_config(ebpf_module_t *modules, netdata_ebpf_load_m
          type_format,
          core_attach,
          collect_pid,
-         (modules->maps_per_core)?"enabled":"disabled"
+         (modules->maps_per_core)?"enabled":"disabled",
+         modules->lifetime
          );
 #endif
 }
diff --git a/libnetdata/ebpf/ebpf.h b/libnetdata/ebpf/ebpf.h
index 455372753d..88dbca3791 100644
--- a/libnetdata/ebpf/ebpf.h
+++ b/libnetdata/ebpf/ebpf.h
@@ -43,6 +43,7 @@
 #define EBPF_CFG_MAPS_PER_CORE "maps per core"
 
 #define EBPF_CFG_UPDATE_EVERY "update every"
+#define EBPF_CFG_LIFETIME "lifetime"
 #define EBPF_CFG_UPDATE_APPS_EVERY_DEFAULT 10
 #define EBPF_CFG_PID_SIZE "pid table size"
 #define EBPF_CFG_APPLICATION "apps"
@@ -270,15 +271,17 @@ typedef enum netdata_apps_integration_flags {
 #define NETDATA_EBPF_STAT_DIMENSION_ARAL "aral"
 
 enum ebpf_threads_status {
-    NETDATA_THREAD_EBPF_RUNNING,
-    NETDATA_THREAD_EBPF_STOPPING,
-    NETDATA_THREAD_EBPF_STOPPED,
-    NETDATA_THREAD_EBPF_NOT_RUNNING
+    NETDATA_THREAD_EBPF_RUNNING,            // started by plugin
+    NETDATA_THREAD_EBPF_FUNCTION_RUNNING,   // started by function
+    NETDATA_THREAD_EBPF_STOPPING,           // stopping thread
+    NETDATA_THREAD_EBPF_STOPPED,            // thread stopped
+    NETDATA_THREAD_EBPF_NOT_RUNNING         // thread was never started
 };
 
 typedef struct ebpf_module {
     const char *thread_name;
     const char *config_name;
+    const char *thread_description;
     enum ebpf_threads_status enabled;
     void *(*start_routine)(void *);
     int update_every;
@@ -306,8 +309,16 @@ typedef struct ebpf_module {
     char memory_usage[NETDATA_EBPF_CHART_MEM_LENGTH];
     char memory_allocations[NETDATA_EBPF_CHART_MEM_LENGTH];
     int maps_per_core;
+
+    // period to run
+    uint32_t running_time; // internal usage, this is used to reset a value when a new request happens.
+    uint32_t lifetime;
 } ebpf_module_t;
 
+#define EBPF_DEFAULT_LIFETIME 300
+// This will be present until all functions are merged
+#define EBPF_NON_FUNCTION_LIFE_TIME 86400
+
 int ebpf_get_kernel_version();
 int get_redhat_release();
 int has_condition_to_run(int version);
@@ -336,6 +347,7 @@ void ebpf_update_map_size(struct bpf_map *map, ebpf_local_maps_t *lmap, ebpf_mod
 typedef struct netdata_ebpf_histogram {
     char *name;
     char *title;
+    char *ctx;
     int order;
     uint64_t histogram[NETDATA_EBPF_HIST_MAX_BINS];
 } netdata_ebpf_histogram_t;
@@ -425,9 +437,11 @@ void ebpf_update_map_type(struct bpf_map *map, ebpf_local_maps_t *w);
 void ebpf_define_map_type(ebpf_local_maps_t *maps, int maps_per_core, int kver);
 #endif
 
-void ebpf_update_kernel_memory_with_vector(ebpf_plugin_stats_t *report, ebpf_local_maps_t *maps);
+void ebpf_update_kernel_memory_with_vector(ebpf_plugin_stats_t *report, ebpf_local_maps_t *maps,
+                                           ebpf_stats_action_t action);
 void ebpf_update_kernel_memory(ebpf_plugin_stats_t *report, ebpf_local_maps_t *map, ebpf_stats_action_t action);
-void ebpf_statistic_create_aral_chart(char *name, ebpf_module_t *em);
+int ebpf_statistic_create_aral_chart(char *name, ebpf_module_t *em);
+void ebpf_statistic_obsolete_aral_chart(ebpf_module_t *em, int prio);
 void ebpf_send_data_aral_chart(ARAL *memory, ebpf_module_t *em);
 
 #endif /* NETDATA_EBPF_H */