Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't drop events while requesting CPU usage from driver #18

Merged
merged 6 commits into from
Mar 24, 2021

Conversation

gnosek
Copy link
Contributor

@gnosek gnosek commented Mar 17, 2021

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area build

/area driver-kmod

/area driver-ebpf

/area libscap

/area libsinsp

/area tests

What this PR does / why we need it:

Every second, we request per-process CPU usage from the driver which generates a stream of sinsp meta events. Unfortunately, whenever we do this, we drop the event we have received from scap_next just before we decided to get the CPU usage data.

This patch moves the logic to a separate method, where an early return does not prevent handling the received event.

Special notes for your reviewer:

This is draios/sysdig#1685 resubmitted

The first commit is required for the fix, 2-3 are minor cleanups, 4-6 (as a whole) are nice to have, unifying CPU usage reporting across udig/eBPF backends

Does this PR introduce a user-facing change?:

new(udig): get CPU usage from /proc (using same method eBPF driver uses)
fix: do not drop event received before requesting per-process CPU usage meta event

gnosek added 6 commits March 17, 2021 15:44
Every second, we request per-process CPU usage from the driver
which generates a stream of sinsp meta events. Unfortunately,
whenever we do this, we drop the event we have received from scap_next
just before we decided to get the CPU usage data.

This patch moves the logic to a separate method, where an early return
does not prevent handling the received event.

Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
No functional changes expected

Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
The code for eBPF gets CPU usage for individual threads
from /proc. We can reuse it for the udig case as well.

Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Even though we don't currently support macOS instrumentation,
not having this struct definition causes compilation warnings.

Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
@poiana
Copy link
Contributor

poiana commented Mar 24, 2021

LGTM label has been added.

Git tree hash: 3eedd39a96c04a939274b22df99bbe4e19195cae

Copy link
Member

@leodido leodido left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great work!

userspace/libsinsp/sinsp.cpp Show resolved Hide resolved
@poiana poiana merged commit d879804 into falcosecurity:master Mar 24, 2021
@poiana
Copy link
Contributor

poiana commented Mar 24, 2021

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: fntlnz, leodido

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@gnosek gnosek deleted the fix-kmod-get-procs-cpu branch March 24, 2021 19:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants