From 90796778733d6c07d259961bdf5b132c61e73ed7 Mon Sep 17 00:00:00 2001 From: Alban Crequy Date: Tue, 9 May 2017 11:01:00 +0200 Subject: [PATCH] ebpf tracker: add callback for lost events Lost events were previously unnoticed. This patch adds an error in the log and stops the ebpf tracker if an event is lost. --- probe/endpoint/ebpf.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/probe/endpoint/ebpf.go b/probe/endpoint/ebpf.go index 6df90c3df..83726132a 100644 --- a/probe/endpoint/ebpf.go +++ b/probe/endpoint/ebpf.go @@ -82,7 +82,7 @@ func newEbpfTracker() (eventTracker, error) { return nil, fmt.Errorf("kernel not supported: %v", err) } - t, err := tracer.NewTracer(tcpEventCbV4, tcpEventCbV6) + t, err := tracer.NewTracer(tcpEventCbV4, tcpEventCbV6, lostCb) if err != nil { return nil, err } @@ -119,6 +119,12 @@ func tcpEventCbV6(e tracer.TcpV6) { // TODO: IPv6 not supported in Scope } +func lostCb(count uint64) { + log.Errorf("tcp tracer lost %d events. Stopping the eBPF tracker", count) + ebpfTracker.dead = true + ebpfTracker.stop() +} + func (t *EbpfTracker) handleConnection(ev tracer.EventType, tuple fourTuple, pid int, networkNamespace string) { t.Lock() defer t.Unlock()