Function initPerfMap

daemon/procmon/ebpf/events.go:151–207

(events *ebpf.Map)

}

func initPerfMap(events *ebpf.Map) error {
	var err error
	eventsReader, err = ringbuf.NewReader(events)
	if err != nil {
		return err
	}
	perfChan := make(chan []byte, ebpfCfg.QueueEventsSize)

	for i := 0; i < ebpfCfg.EventsWorkers; i++ {
		go streamEventsWorker(i, perfChan, kernelEvents)
	}

	go func(perfChan chan []byte, rd *ringbuf.Reader) {
		// drainPerfChain drains the channel if it gets full.
		// This can happen when there're too much events and the queue size is
		// not big enough to hold all the events.
		// To prevent blocking the ringbuf channel, we need to discard the events
		// from the queue, so the ringbuf can continue sending events from kernel space.
		drainPerfChan := func() {
			for {
				select {
				case <-perfChan:
				default:
					return
				}
			}
		}

		for {
			select {
			case <-ctxTasks.Done():
				goto Exit
			default:
				record, err := rd.Read()
				if err != nil {
					if errors.Is(err, ringbuf.ErrClosed) {
						goto Exit
					}
					// XXX: control max errors?
					log.Trace("[eBPF events] reader error: %s", err)
					continue
				}

				select {
				case perfChan <- record.RawSample:
				default:
					log.Debug("[eBPF] events queue full (%d/%d), ringbuf record lost. Try increasing the queue size and/or the number of workers", len(perfChan), cap(perfChan))
					drainPerfChan()
				}
			}
		}
	Exit:
		log.Debug("[eBPF events] reader closed")
	}(perfChan, eventsReader)

	return nil
}