From 6e715d26977a91a4870a65941dbb49e356207c81 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Tue, 13 Aug 2019 16:16:16 +0000 Subject: [PATCH] fix(probe): Loosen ebpf parameters to reduce restarts Delay kernel events by up to 0.2ms, to reduce the chance the ebpf reporter sends them out-of-order, and allow out-of-order events to happen up to once a minute without giving up on the ebpf reporter. --- probe/endpoint/connection_tracker.go | 4 ++-- probe/endpoint/ebpf.go | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/probe/endpoint/connection_tracker.go b/probe/endpoint/connection_tracker.go index e65c4d3c5..db9764b4e 100644 --- a/probe/endpoint/connection_tracker.go +++ b/probe/endpoint/connection_tracker.go @@ -87,8 +87,8 @@ func (t *connectionTracker) ReportConnections(rpt *report.Report) { ebpfLastFailureTime := t.ebpfLastFailureTime t.ebpfLastFailureTime = time.Now() - if ebpfLastFailureTime.After(time.Now().Add(-5 * time.Minute)) { - // Multiple failures in the last 5 minutes, fall back to proc parsing + if ebpfLastFailureTime.After(time.Now().Add(-1 * time.Minute)) { + // Multiple failures in the last minute, fall back to proc parsing log.Warnf("ebpf tracker died again, gently falling back to proc scanning") t.useProcfs() } else { diff --git a/probe/endpoint/ebpf.go b/probe/endpoint/ebpf.go index 2a1e1aefe..aca292851 100644 --- a/probe/endpoint/ebpf.go +++ b/probe/endpoint/ebpf.go @@ -129,6 +129,7 @@ func newEbpfTracker() (*EbpfTracker, error) { debugBPF = true } + tracer.TimestampOffset = 200000 // Delay events by 0.2ms to avoid out-of-order reporting tracker := &EbpfTracker{ debugBPF: debugBPF, }