Add watcher for Kernel Events via ebpf #37833
Conversation
Add a global watcher which can be used by clients to receive kernel events via ebpf.
botelastic
bot
added
the
needs_team
|
This pull request does not have a backport label.
To fixup this pull request, you need to add the backport labels for the needed
|
libbeat/ebpf/watcher_linux.go
Outdated
| if gWatcher.status == stopped { | ||
| l, err := ebpfevents.NewLoader() | ||
| if err != nil { | ||
| gWatcherErr = fmt.Errorf("init ebpf loader: %w", err) |
There was a problem hiding this comment.
Is it necessary to use a global for this? If it needs to be retained between calls (though why? I don't see it being accessed anywhere) it can be kept in the Watcher.
There was a problem hiding this comment.
I've moved err into the Watcher struct.
This is needed so that subsequent callers of GetWatcher can get the same error as the first call. The most likely cause of the error is that the system doesn't support ebpf, so there's no point retrying, but the other callers should still get the error. So the error needs to be kept in a global. But if you know a better way to do this, I can change
There was a problem hiding this comment.
Yeah, OK. Keeping it in the struct is the conventional approach to make errors sticky. Then you can check the err field on method entry and return the error if it is non-nil. You can also have an Err() error method to return the error if you think it will be helpful (probably not here).
Because of the prevalence of concurrency in Go, use of globals is avoided, and if it can't be, try to make any singleton have only one entry (having the error as an associated global essentially makes the singleton doubly rooted).
libbeat/ebpf/watcher_linux.go
Outdated
|
|
||
| var ( | ||
| gWatcherOnce sync.Once | ||
| gWatcherErr error |
There was a problem hiding this comment.
Why are we using a global error?
| ctx, gWatcher.cancel = context.WithCancel(context.Background()) | ||
|
|
||
| go gWatcher.loader.EventLoop(ctx, records) | ||
| go func(ctx context.Context) { |
There was a problem hiding this comment.
You can close over ctx, though this is a matter of personal style.
mjwolf
added
the
Team:Security-Linux Platform
|
Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform) |
botelastic
bot
removed
the
needs_team
mjwolf
added
the
backport-skip
💚 Build Succeeded
Expand to view the summary
Build stats
❕ Flaky test reportNo test was executed to be analysed. 🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
- Remove global error - Move methods onto struct - Remove unneeded seccomp policy on arm
❕ Build Aborted
Expand to view the summary
Build stats
Steps errors
Expand to view the steps failures
|
❕ Build Aborted
Expand to view the summary
Build stats
🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
💚 Flaky test reportTests succeeded. 🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
|
Pinging @elastic/elastic-agent (Team:Elastic-Agent) |
💔 Build Failed
Failed CI Stepscc @mjwolf |
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
💚 Flaky test reportTests succeeded. 🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
This adds a watcher that will watch for Linux kernel events, using ebpf via the ebpfevents library, and send the events to subscribed clients. By using a single global watcher, multiple clients can subscribe and receive kernel events, while avoiding increasing the amount of kernel resources used (e.g. avoiding having multiple ebpf probes/maps).
Add a global watcher which can be used by clients to receive kernel events via ebpf.
Proposed commit message
This adds a watcher that will watch for Linux kernel events, using ebpf via the ebpfevents library, and send the events to subscribed clients.
By using a single global watcher, multiple clients can subscribe and receive kernel events, while avoiding increasing the amount of kernel resources used (e.g. avoiding having multiple ebpf probes/maps).
Checklist
I have made corresponding changes to the documentationI have made corresponding change to the default configuration filesCHANGELOG.next.asciidocorCHANGELOG-developer.next.asciidoc.Related issues
Both these PRs will use this watcher. This code was part of both of these PRs, but as that code is diverging, this PR is created to have a single branch with the watcher. These PRs will be updated to use this code, once it's merged.