@@ -9,22 +9,17 @@ Linux Kernel eBPF Collectors
99
1010The respository has the following directory structure:
1111
12- - ` artifacts ` : Directory that will have the eBPF programs and shared libraries when the compilation process ends.
12+ - ` artifacts ` : Directory that will have the eBPF programs when the compilation process ends.
1313- ` includes ` : Common headers
1414- ` kernel ` : The eBPF programs source code
15- - ` lib ` : The libelf static used to create the shared library.
16- - ` library ` : Codes from Linux kernel-source changed to create the shared library.
17- - ` libbpf_0_0_1 ` : An inexistent version of the libbpf library, we changed it to support old Linux kernels.
18- - ` libbpf ` : The latest libbpf version from kernel.
19- - ` tools ` : scripts used to verify system status before to install or test any eBPF code.
20- - ` user ` : Software to tests the eBPF program
15+ - ` tools ` : scripts used to verify system status before installing eBPF code.
2116
2217## Necessary packages
2318
24- To compile the shared libraries and the eBPF programs, it will be necessary to have the following packages:
19+ To compile the eBPF programs, it will be necessary to have the following packages:
2520
2621- Libelf headers
27- - llvm/clang , because GCC cannot compile eBPF codes .
22+ - llvm/clang, because GCC prior to 10.0 cannot compile eBPF code .
2823- Kernel headers
2924
3025The last group of files can be extracted direct from kernel source doing the following steps:
@@ -37,7 +32,7 @@ make prepare
3732make headers_install
3833```
3934
40- Case you are using the kernel ` 5.4 ` or newer, it is necessary to comment the following line inside the file
35+ In case you are using the kernel ` 5.4 ` or newer, it is necessary to comment the following line inside the file
4136 ` generated/autoconf.h ` :
4237
4338```
@@ -46,13 +41,13 @@ Case you are using the kernel `5.4` or newer, it is necessary to comment the fol
4641
4742## Necessary changes
4843
49- Before to compile this repository, it is necessary to change the Makefiles according your environment. The original
44+ Before compilation of this repository, it is necessary to change the Makefiles according your environment. The original
5045files were adjusted to compile on Slackware Linux Current.
5146
5247
5348### ` kernel/Makefile `
5449
55- Inside this file probably it will be neecssary to change the following variable:
50+ Inside this file probably it will be necessary to change the following variable:
5651
5752- ` KERNELSOURCE ` : Where is your kernel-source? This variable was set initially to work on Slackware, Fedora and Ubuntu
5853- ` KERNELBUILD ` : Directory where the headers are expected to be stored.
@@ -112,46 +107,28 @@ This sets `EXTRA_CFLAGS=-g` up before building.
112107
113108## Compilation (manually)
114109
115- After to do the necessaries changes inside the file ` kernel/Makefille ` , to compile the libraries
116- and the eBPF programs, you only need to do the following steps :
110+ After the necessary changes have been done inside the ` kernel/Makefille ` file, you need to run the following
111+ command to compile the eBPF programs :
117112
118113``` bash
119- # cd user
120114# make
121115```
122116
123- When the compilation finishes, you will have inside ` artificats ` directory a file with the following
117+ When the compilation finishes, you will have a file inside ` artifacts ` directory with the following
124118content:
125119
126120```
127- usr/lib64/libbpf_kernel.so
128- libnetdata_ebpf.so
129- dnetdata_ebpf_process.o
130- pnetdata_ebpf_process.o
131- rnetdata_ebpf_process.o
121+ pnetdata_ebpf_process.<kernel version>.o
122+ pnetdata_ebpf_socket.<kernel version>.o
123+ rnetdata_ebpf_process.<kernel version>.o
124+ rnetdata_ebpf_socket.<kernel version>.o
132125```
133126
134- We can group these files as:
127+ ` p*.o ` : eBPF programs used with entry mode, this is the default mode.
128+ ` r*.o ` : eBPF programs used with return mode.
135129
136- - ` libbpf_kernel.so ` : This is the libbpf shared library that must be moved to a directory listed inside
137- ` /etc/ld.so.conf ` , when you move it for one of the directory, it will be necessary to create a symbolic link,
138- for example, let us assume that the distribution uses ` /usr/lib64/ ` to store shared libraries, the following
139- commands are necessaries:
140-
141- ``` bash
142- cp usr/lib64/libbpf_kernel.so /usr/lib64/
143- ln -s /usr/lib64/libbpf_kernel.so /usr/lib64/libbpf_kernel.so.0
144- ```
145-
146- - ` Collector files ` : the collector works with all files created during the compilation, but the next 4 files
147- need to be copied to ` /usr/libexec/netdata/plugins.d ` for the collector to have condition to access them:
148- - ` libnetdata_ebpf.so ` : Shared library used to load the eBPF programs.
149- - ` dnetdata_ebpf_process.o ` : eBPF program used with developer mode.
150- - ` pnetdata_ebpf_process.o ` : eBPF program used with entry mode, this is the default mode.
151- - ` rnetdata_ebpf_process.o ` : eBPF program used with return mode.
152-
153-
154- After this you can start the new collector ` ebpf_program.plugin ` .
130+ These files have to be copied to your plugins directory, which is usually at ` /usr/libexec/netdata/plugins.d/ ` ,
131+ for the collector to be able to access them. After this you can start the new collector ` ebpf_program.plugin ` .
155132
156133## Releasing
157134
0 commit comments