| 47 | } |
| 48 | |
| 49 | func (this *MSyscall) setupManager() error { |
| 50 | maps := []*manager.Map{} |
| 51 | probes := []*manager.Probe{} |
| 52 | |
| 53 | events_map := &manager.Map{ |
| 54 | Name: "events", |
| 55 | } |
| 56 | maps = append(maps, events_map) |
| 57 | |
| 58 | fork_probe := &manager.Probe{ |
| 59 | Section: "raw_tracepoint/sched_process_fork", |
| 60 | EbpfFuncName: "tracepoint__sched__sched_process_fork", |
| 61 | } |
| 62 | probes = append(probes, fork_probe) |
| 63 | |
| 64 | // syscall hook 配置 |
| 65 | sys_enter_probe := &manager.Probe{ |
| 66 | Section: "raw_tracepoint/sys_enter", |
| 67 | EbpfFuncName: "raw_syscalls_sys_enter", |
| 68 | } |
| 69 | sys_exit_probe := &manager.Probe{ |
| 70 | Section: "raw_tracepoint/sys_exit", |
| 71 | EbpfFuncName: "raw_syscalls_sys_exit", |
| 72 | } |
| 73 | probes = append(probes, sys_enter_probe) |
| 74 | probes = append(probes, sys_exit_probe) |
| 75 | |
| 76 | this.bpfManager = &manager.Manager{ |
| 77 | Probes: probes, |
| 78 | Maps: maps, |
| 79 | } |
| 80 | return nil |
| 81 | } |
| 82 | |
| 83 | func (this *MSyscall) setupManagerOptions() { |
| 84 | // 对于没有开启 CONFIG_DEBUG_INFO_BTF 的加载额外的 btf.Spec |