eBPF ext4 (new thread for collector) (netdata#11224)

* ebpf_ext4: Add new thread * ebpf_ext4: Add configuration files * ebpf_ext4: Add helpers to identify partitions and main threads * ebpf_ext4: Add helpers to create chart * ebpf_ext4: Add functions to read data from kernel ring * ebpf_ext4: Add functions to send data to Netdata * ebpf_ext4: Adjust dimensions * ebpf_ext4: Add information for dashboard * ebpf_ext4: Update documentation * ebpf_ext4: Update algorithm to read Array table instead hash table * ebpf_ext4: Add new eBPF version * ebpf_ext4: Add obsolete chart * ebpf_ext4: Fix coverity report * ebpf_ext4: Fix grammar in readme.md * ebpf_ext4: Update link inside dashboard_info.js * ebpf_ext4: Rename function and remove unused options inside filesystem.conf * ebpf_ext4: Rename variables and fix format * ebpf_ext4: Rename more variables * ebpf_ext4: Update algorithm to create dimensions * ebpf_ext4: Fix comment grammar * ebpf_ext4: Add messages to simplify comparison with hash table * ebpf_ext4: Update eBPF release * ebpf_ext4: Remove variables to improve the buckets * ebpf_ext4: Update algorithm to select filesystem * ebpf_ext4: Remove messages * ebpf_ext4: Add comment to filesystem
tvarsis · Jun 8, 2021 · 9f1c1bd · 9f1c1bd
1 parent becf726
commit 9f1c1bd
Show file tree

Hide file tree

Showing 17 changed files with 956 additions and 24 deletions.
diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -490,6 +490,8 @@ set(EBPF_PROCESS_PLUGIN_FILES
         collectors/ebpf.plugin/ebpf_cachestat.h
         collectors/ebpf.plugin/ebpf_dcstat.c
         collectors/ebpf.plugin/ebpf_dcstat.h
+        collectors/ebpf.plugin/ebpf_filesystem.c
+        collectors/ebpf.plugin/ebpf_filesystem.h
         collectors/ebpf.plugin/ebpf_process.c
         collectors/ebpf.plugin/ebpf_process.h
         collectors/ebpf.plugin/ebpf_socket.c

diff --git a/Makefile.am b/Makefile.am
@@ -289,6 +289,8 @@ EBPF_PLUGIN_FILES = \
     collectors/ebpf.plugin/ebpf_cachestat.h \
     collectors/ebpf.plugin/ebpf_dcstat.c \
     collectors/ebpf.plugin/ebpf_dcstat.h \
+    collectors/ebpf.plugin/ebpf_filesystem.c \
+    collectors/ebpf.plugin/ebpf_filesystem.h \
     collectors/ebpf.plugin/ebpf_process.c \
     collectors/ebpf.plugin/ebpf_process.h \
     collectors/ebpf.plugin/ebpf_socket.c \

diff --git a/collectors/all.h b/collectors/all.h
@@ -150,6 +150,8 @@
 #define NETDATA_CHART_PRIO_FILESYSTEM_VFS_IO_CREATE   2158
 #define NETDATA_CHART_PRIO_FILESYSTEM_VFS_IO_ECREATE  2159
 
+#define NETDATA_CHART_PRIO_EBPF_FILESYSTEM_CHARTS     2160
+
 // NFS (server)
 
 #define NETDATA_CHART_PRIO_NFSD_READCACHE             2200

diff --git a/collectors/ebpf.plugin/Makefile.am b/collectors/ebpf.plugin/Makefile.am
@@ -34,6 +34,7 @@ dist_ebpfconfig_DATA = \
     ebpf.d/ebpf_kernel_reject_list.txt \
     ebpf.d/cachestat.conf \
     ebpf.d/dcstat.conf \
+    ebpf.d/filesystem.conf \
     ebpf.d/network.conf \
     ebpf.d/process.conf \
     ebpf.d/sync.conf \

diff --git a/collectors/ebpf.plugin/README.md b/collectors/ebpf.plugin/README.md
@@ -216,6 +216,7 @@ The eBPF collector enables and runs the following eBPF programs by default:
 -   `dcstat` : This eBPF program creates charts that show information about file access using directory cache. It appends
     `kprobes` for `lookup_fast()` and `d_lookup()` to identify if files are inside directory cache, outside and 
     files are not found.
+-   `filesystem`: This eBPF program creates charts that show latency information for selected filesystem.
 -   `process`: This eBPF program creates charts that show information about process creation, calls to open files.
     When in `return` mode, it also creates charts showing errors when these operations are executed.
 -   `network viewer`: This eBPF program creates charts with information about `TCP` and `UDP` functions, including the
@@ -239,6 +240,7 @@ The following configuration files are available:
 
 - `cachestat.conf`: Configuration for the `cachestat` thread.
 - `dcstat.conf`: Configuration for the `dcstat` thread.
+- `filesystem.conf`: Configuration for the `filesystem` thread.
 - `process.conf`: Configuration for the `process` thread.
 - `network.conf`: Configuration for the `network viewer` thread. This config file overwrites the global options and
   also lets you specify which network the eBPF collector monitors.
@@ -315,6 +317,16 @@ monitored.
     sync_file_range = yes
 ```
 
+### Filesystem configuration
+
+The filesystem configuration has specific options to disable monitoring for filesystems, by default all 
+filesystems are monitored.
+
+```conf
+[filesystem]
+    ext4dist = yes
+```
+
 ## Troubleshooting
 
 If the eBPF collector does not work, you can troubleshoot it by running the `ebpf.plugin` command and investigating its

diff --git a/collectors/ebpf.plugin/ebpf.c b/collectors/ebpf.plugin/ebpf.c
@@ -109,6 +109,11 @@ ebpf_module_t ebpf_modules[] = {
       .optional = 0, .apps_routine = ebpf_vfs_create_apps_charts, .maps = NULL,
       .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &vfs_config,
       .config_file = NETDATA_DIRECTORY_VFS_CONFIG_FILE },
+    { .thread_name = "filesystem", .config_name = "filesystem", .enabled = 0, .start_routine = ebpf_filesystem_thread,
+      .update_time = 1, .global_charts = 1, .apps_charts = 1, .mode = MODE_ENTRY,
+      .optional = 0, .apps_routine = NULL, .maps = NULL,
+      .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &fs_config,
+      .config_file = NETDATA_SYNC_CONFIG_FILE},
     { .thread_name = NULL, .enabled = 0, .start_routine = NULL, .update_time = 1,
       .global_charts = 0, .apps_charts = 1, .mode = MODE_ENTRY,
       .optional = 0, .apps_routine = NULL, .maps = NULL, .pid_map_size = 0, .names = NULL,
@@ -389,6 +394,33 @@ void ebpf_write_chart_cmd(char *type, char *id, char *title, char *units, char *
            update_every);
 }
 
+/**
+ * Write chart cmd on standard output
+ *
+ * @param type      chart type
+ * @param id        chart id
+ * @param title     chart title
+ * @param units     units label
+ * @param family    group name used to attach the chart on dashboard
+ * @param charttype chart type
+ * @param context   chart context
+ * @param order     chart order
+ */
+void ebpf_write_chart_obsolete(char *type, char *id, char *title, char *units, char *family,
+                               char *charttype, char *context, int order)
+{
+    printf("CHART %s.%s '' '%s' '%s' '%s' '%s' '%s' %d %d 'obsolete'\n",
+           type,
+           id,
+           title,
+           units,
+           (family)?family:"",
+           (context)?context:"",
+           (charttype)?charttype:"",
+           order,
+           update_every);
+}
+
 /**
  * Write the dimension command on standard output
  *
@@ -625,6 +657,8 @@ void ebpf_print_help()
             "\n"
             " --dcstat or -d      Enable charts related to directory cache.\n"
             "\n"
+            " --filesystem or -i  Enable chart related to filesystem run time.\n"
+            "\n"
             " --net or -n         Enable network viewer charts.\n"
             "\n"
             " --process or -p     Enable charts related to process run time.\n"
@@ -940,6 +974,13 @@ static void read_collector_values(int *disable_apps)
         started++;
     }
 
+    enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, "filesystem",
+                                    CONFIG_BOOLEAN_NO);
+    if (enabled) {
+        ebpf_enable_chart(EBPF_MODULE_FILESYSTEM_IDX, *disable_apps);
+        started++;
+    }
+
     if (!started){
         ebpf_enable_all_charts(*disable_apps);
         // Read network viewer section
@@ -1018,18 +1059,19 @@ static void parse_args(int argc, char **argv)
     int freq = 0;
     int option_index = 0;
     static struct option long_options[] = {
-        {"help",      no_argument,    0,  'h' },
-        {"version",   no_argument,    0,  'v' },
-        {"global",    no_argument,    0,  'g' },
-        {"all",       no_argument,    0,  'a' },
-        {"cachestat", no_argument,    0,  'c' },
-        {"dcstat",    no_argument,    0,  'd' },
-        {"net",       no_argument,    0,  'n' },
-        {"process",   no_argument,    0,  'p' },
-        {"return",    no_argument,    0,  'r' },
-        {"sync",      no_argument,    0,  's' },
-        {"swap",      no_argument,    0,  'w' },
-        {"vfs",       no_argument,    0,  'f' },
+        {"help",       no_argument,    0,  'h' },
+        {"version",    no_argument,    0,  'v' },
+        {"global",     no_argument,    0,  'g' },
+        {"all",        no_argument,    0,  'a' },
+        {"cachestat",  no_argument,    0,  'c' },
+        {"dcstat",     no_argument,    0,  'd' },
+        {"filesystem", no_argument,    0,  'i' },
+        {"net",        no_argument,    0,  'n' },
+        {"process",    no_argument,    0,  'p' },
+        {"return",     no_argument,    0,  'r' },
+        {"sync",       no_argument,    0,  's' },
+        {"swap",       no_argument,    0,  'w' },
+        {"vfs",        no_argument,    0,  'f' },
         {0, 0, 0, 0}
     };
 
@@ -1088,6 +1130,14 @@ static void parse_args(int argc, char **argv)
 #ifdef NETDATA_INTERNAL_CHECKS
                 info(
                     "EBPF enabling \"DCSTAT\" charts, because it was started with the option \"--dcstat\" or \"-d\".");
+#endif
+                break;
+            }
+            case 'i': {
+                enabled = 1;
+                ebpf_enable_chart(EBPF_MODULE_FILESYSTEM_IDX, disable_apps);
+#ifdef NETDATA_INTERNAL_CHECKS
+                info("EBPF enabling \"filesystem\" chart, because it was started with the option \"--filesystem\" or \"-i\".");
 #endif
                 break;
             }
@@ -1285,6 +1335,8 @@ int main(int argc, char **argv)
             NULL, NULL, ebpf_modules[EBPF_MODULE_SWAP_IDX].start_routine},
         {"EBPF VFS" , NULL, NULL, 1,
             NULL, NULL, ebpf_modules[EBPF_MODULE_VFS_IDX].start_routine},
+        {"EBPF FILESYSTEM" , NULL, NULL, 1,
+            NULL, NULL, ebpf_modules[EBPF_MODULE_FILESYSTEM_IDX].start_routine},
         {NULL          , NULL, NULL, 0,
           NULL, NULL, NULL}
     };

diff --git a/collectors/ebpf.plugin/ebpf.d.conf b/collectors/ebpf.plugin/ebpf.d.conf
@@ -25,17 +25,19 @@
 #
 # The eBPF collector enables and runs the following eBPF programs by default:
 #
-#  `cachestat`: Make charts for kernel functions related to page cache.
-#  `process`  : This eBPF program creates charts that show information about process creation, and file manipulation.
-#  `socket`   : This eBPF program creates charts with information about `TCP` and `UDP` functions, including the
-#               bandwidth consumed by each.
-#  `sync`     : Montitor calls for syscall sync(2).             
-#  `swap`     : Monitor calls for internal swap functions.
-#  `vfs`      : This eBPF program creates charts that show information about process VFS IO, VFS file manipulation and
+#  `cachestat` : Make charts for kernel functions related to page cache.
+#  `filesystem`: Monitor calls for functions used to manipulate specific filesystems
+#  `process`   : This eBPF program creates charts that show information about process creation, and file manipulation.
+#  `socket`    : This eBPF program creates charts with information about `TCP` and `UDP` functions, including the
+#                bandwidth consumed by each.
+#  `sync`      : Montitor calls for syscall sync(2).             
+#  `swap`      : Monitor calls for internal swap functions.
+#  `vfs`       : This eBPF program creates charts that show information about process VFS IO, VFS file manipulation and
 #               files removed.
 [ebpf programs]
     cachestat = no
     dcstat = no
+    filesystem = no
     process = yes
     socket = yes
     sync = yes

diff --git a/collectors/ebpf.plugin/ebpf.d/filesystem.conf b/collectors/ebpf.plugin/ebpf.d/filesystem.conf
@@ -0,0 +1,16 @@
+# The `ebpf load mode` option accepts the following values :
+#  `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
+#  `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
+#            new charts for the return of these functions, such as errors.
+#
+# The eBPF collector also creates charts for each running application through an integration with the `apps plugin`.
+# If you want to disable the integration with `apps.plugin` along with the above charts, change the setting `apps` to
+# 'no'.
+#  
+[global]
+    ebpf load mode = entry
+    update every = 2
+
+# All filesystems are named as 'NAMEdist' where NAME is the filesystem name while 'dist' is a reference for distribution.
+[filesystem]
+    ext4dist = yes
diff --git a/collectors/ebpf.plugin/ebpf.h b/collectors/ebpf.plugin/ebpf.h
@@ -80,7 +80,8 @@ enum ebpf_module_indexes {
     EBPF_MODULE_SYNC_IDX,
     EBPF_MODULE_DCSTAT_IDX,
     EBPF_MODULE_SWAP_IDX,
-    EBPF_MODULE_VFS_IDX
+    EBPF_MODULE_VFS_IDX,
+    EBPF_MODULE_FILESYSTEM_IDX
 };
 
 // Copied from musl header
@@ -223,6 +224,8 @@ extern void ebpf_cachestat_create_apps_charts(struct ebpf_module *em, void *root
 extern void ebpf_one_dimension_write_charts(char *family, char *chart, char *dim, long long v1);
 extern collected_number get_value_from_structure(char *basis, size_t offset);
 extern void ebpf_update_pid_table(ebpf_local_maps_t *pid, ebpf_module_t *em);
+extern void ebpf_write_chart_obsolete(char *type, char *id, char *title, char *units, char *family,
+                                      char *charttype, char *context, int order);
 
 #define EBPF_MAX_SYNCHRONIZATION_TIME 300
 

diff --git a/collectors/ebpf.plugin/ebpf_apps.h b/collectors/ebpf.plugin/ebpf_apps.h
@@ -20,6 +20,7 @@
 
 #include "ebpf_process.h"
 #include "ebpf_dcstat.h"
+#include "ebpf_filesystem.h"
 #include "ebpf_cachestat.h"
 #include "ebpf_sync.h"
 #include "ebpf_swap.h"