Slide 32
Slide 32 text
Exit: eBPF Program
主な処理: Exit Event (msg_exit)を組み立て、eBPF Map: tcpmon_mapに書き込む
Tetragon eBPF: bpf_exit.cの kprobe/acct_process
section
Tetragon eBPF: bpf_exit.h
47 __attribute__((section("kprobe/acct_process"), used)) int
48 event_exit_acct_process(struct pt_regs *ctx)
49 {
50 __u64 pid_tgid = get_current_pid_tgid();
51
52 event_exit_send(ctx, pid_tgid >> 32);
53 return 0;
54 }
FUNC_INLINE void event_exit_send(void *ctx, __u32 tgid)
{
struct msg_exit *exit;
exit->info.tid = tgid;
...
perf_event_output_metric(ctx, MSG_OP_EXIT, &tcpmon_map,
BPF_F_CURRENT_CPU, exit, size); // Write msg_exit to tcpmon_map