• Brenden Blanco's avatar
    Improve coverage for kprobe event_re · 7e71aef9
    Brenden Blanco authored
    This makes the attachment of kprobes to arbitrary events more robust.
    
    Issue 1: Functions with '.' characters should not have similarly named
     probes.
    Issue 2: Functions in the blacklist should not be attached to.
    Issue 3: Some functions matched by regex cannot actually be attached to,
     despite not being in the blacklist...possibly the blacklist is outdated?
     Instead, warn instead of error during bulk regex attach.
    Issue 4: Attaching to large numbers of kprobes gets to be very slow. For
     now, leave this unresolved. For reasonably sized regexes, startup times
     may be acceptable, and shutdown times are actually the worse part. To
     speed up shutdown, one could add the following after the last
     attach_kprobe to disable auto-cleanup:
      ```
      from bcc import open_kprobes
      open_kprobes = {}
      ```
     Then, once the program is exited, one must manually
      echo "" > kprobe_events
    
    Some numbers:
    attaching to event_re='tcp_*': 2 sec startup, 15 sec shutdown
    attaching to event_re='b*': 10 sec startup, 75 sec shutdown
    attaching to event_re='*': unknown (>20 min) startup, unknown shutdown
    The slowdowns appear to be exponential, doubtful that '*' will ever
    complete.
    
    Fixes: #199
    Signed-off-by: default avatarBrenden Blanco <bblanco@plumgrid.com>
    7e71aef9
libbpf.c 7.07 KB