@@ -9,22 +9,17 @@ Linux Kernel eBPF Collectors
9
9
10
10
The respository has the following directory structure:
11
11
12
- - ` artifacts ` : Directory that will have the eBPF programs and shared libraries when the compilation process ends.
12
+ - ` artifacts ` : Directory that will have the eBPF programs when the compilation process ends.
13
13
- ` includes ` : Common headers
14
14
- ` kernel ` : The eBPF programs source code
15
- - ` lib ` : The libelf static used to create the shared library.
16
- - ` library ` : Codes from Linux kernel-source changed to create the shared library.
17
- - ` libbpf_0_0_1 ` : An inexistent version of the libbpf library, we changed it to support old Linux kernels.
18
- - ` libbpf ` : The latest libbpf version from kernel.
19
- - ` tools ` : scripts used to verify system status before to install or test any eBPF code.
20
- - ` user ` : Software to tests the eBPF program
15
+ - ` tools ` : scripts used to verify system status before installing eBPF code.
21
16
22
17
## Necessary packages
23
18
24
- To compile the shared libraries and the eBPF programs, it will be necessary to have the following packages:
19
+ To compile the eBPF programs, it will be necessary to have the following packages:
25
20
26
21
- Libelf headers
27
- - llvm/clang , because GCC cannot compile eBPF codes .
22
+ - llvm/clang, because GCC prior to 10.0 cannot compile eBPF code .
28
23
- Kernel headers
29
24
30
25
The last group of files can be extracted direct from kernel source doing the following steps:
@@ -37,7 +32,7 @@ make prepare
37
32
make headers_install
38
33
```
39
34
40
- Case you are using the kernel ` 5.4 ` or newer, it is necessary to comment the following line inside the file
35
+ In case you are using the kernel ` 5.4 ` or newer, it is necessary to comment the following line inside the file
41
36
` generated/autoconf.h ` :
42
37
43
38
```
@@ -46,13 +41,13 @@ Case you are using the kernel `5.4` or newer, it is necessary to comment the fol
46
41
47
42
## Necessary changes
48
43
49
- Before to compile this repository, it is necessary to change the Makefiles according your environment. The original
44
+ Before compilation of this repository, it is necessary to change the Makefiles according your environment. The original
50
45
files were adjusted to compile on Slackware Linux Current.
51
46
52
47
53
48
### ` kernel/Makefile `
54
49
55
- Inside this file probably it will be neecssary to change the following variable:
50
+ Inside this file probably it will be necessary to change the following variable:
56
51
57
52
- ` KERNELSOURCE ` : Where is your kernel-source? This variable was set initially to work on Slackware, Fedora and Ubuntu
58
53
- ` KERNELBUILD ` : Directory where the headers are expected to be stored.
@@ -112,46 +107,28 @@ This sets `EXTRA_CFLAGS=-g` up before building.
112
107
113
108
## Compilation (manually)
114
109
115
- After to do the necessaries changes inside the file ` kernel/Makefille ` , to compile the libraries
116
- and the eBPF programs, you only need to do the following steps :
110
+ After the necessary changes have been done inside the ` kernel/Makefille ` file, you need to run the following
111
+ command to compile the eBPF programs :
117
112
118
113
``` bash
119
- # cd user
120
114
# make
121
115
```
122
116
123
- When the compilation finishes, you will have inside ` artificats ` directory a file with the following
117
+ When the compilation finishes, you will have a file inside ` artifacts ` directory with the following
124
118
content:
125
119
126
120
```
127
- usr/lib64/libbpf_kernel.so
128
- libnetdata_ebpf.so
129
- dnetdata_ebpf_process.o
130
- pnetdata_ebpf_process.o
131
- rnetdata_ebpf_process.o
121
+ pnetdata_ebpf_process.<kernel version>.o
122
+ pnetdata_ebpf_socket.<kernel version>.o
123
+ rnetdata_ebpf_process.<kernel version>.o
124
+ rnetdata_ebpf_socket.<kernel version>.o
132
125
```
133
126
134
- We can group these files as:
127
+ ` p*.o ` : eBPF programs used with entry mode, this is the default mode.
128
+ ` r*.o ` : eBPF programs used with return mode.
135
129
136
- - ` libbpf_kernel.so ` : This is the libbpf shared library that must be moved to a directory listed inside
137
- ` /etc/ld.so.conf ` , when you move it for one of the directory, it will be necessary to create a symbolic link,
138
- for example, let us assume that the distribution uses ` /usr/lib64/ ` to store shared libraries, the following
139
- commands are necessaries:
140
-
141
- ``` bash
142
- cp usr/lib64/libbpf_kernel.so /usr/lib64/
143
- ln -s /usr/lib64/libbpf_kernel.so /usr/lib64/libbpf_kernel.so.0
144
- ```
145
-
146
- - ` Collector files ` : the collector works with all files created during the compilation, but the next 4 files
147
- need to be copied to ` /usr/libexec/netdata/plugins.d ` for the collector to have condition to access them:
148
- - ` libnetdata_ebpf.so ` : Shared library used to load the eBPF programs.
149
- - ` dnetdata_ebpf_process.o ` : eBPF program used with developer mode.
150
- - ` pnetdata_ebpf_process.o ` : eBPF program used with entry mode, this is the default mode.
151
- - ` rnetdata_ebpf_process.o ` : eBPF program used with return mode.
152
-
153
-
154
- After this you can start the new collector ` ebpf_program.plugin ` .
130
+ These files have to be copied to your plugins directory, which is usually at ` /usr/libexec/netdata/plugins.d/ ` ,
131
+ for the collector to be able to access them. After this you can start the new collector ` ebpf_program.plugin ` .
155
132
156
133
## Releasing
157
134
0 commit comments