13–15 Nov 2023
America/New_York timezone

Where have all the kprobes gone

14 Nov 2023, 10:00
30m
"James River Salon C" (Omni Richmond Hotel)

"James River Salon C"

Omni Richmond Hotel

225
eBPF & Networking Track eBPF & Networking

Speaker

Jiri Olsa (Isovalent)

Description

We recently suffered a case where we did not get expected count of
attached kprobe hits and I realized that we don't properly keep stats
of missed probes.

While this was not surprise for legacy kprobes (perf + SET_BPF ioctl)
which was brought up long time ago, it's currently not possible get
such stats even on kprobes created on top of bpf perf and kprobe_multi
links.

Also we are missing recursion accounting of BPF layer on several places
that can drop kprobe and related BPF program execution.

In this talk I'll go through all BPF related tracing probes and show
where the probe can get lost and how the user can keep track of that.

Primary author

Jiri Olsa (Isovalent)

Presentation materials

Diamond Sponsors

Platinum Sponsor
Gold Sponsors




Silver Sponsors



Catchbox Sponsor
Livestream Sponsors

T-Shirt Sponsor
Conference Services Provided by