Katyusha's blog

1
package collector
2

3
import (
4
  "fmt"
5
  "time"
6

7
  "github.com/cilium/ebpf/link"
8
  "github.com/cilium/ebpf/rlimit"
9

10
  "github.com/os2026/ebpf-rca/internal/syscalls"
11
)
12

13
// scKey 与 syscall.bpf.c 中的 struct sc_key 布局一致。
14
type scKey struct {
15
  Pid uint32
16
  Nr  uint32
17
}
18

19
// scStat 与 syscall.bpf.c 中的 struct sc_stat 布局一致。
20
type scStat struct {
21
  Count   uint64
22
  TotalNs uint64
23
  MaxNs   uint64
24
  Comm    [16]byte
25
}
26

27
// SyscallSample 是单个 (进程, syscall) 在窗口内的派生指标。
28
type SyscallSample struct {
29
  Pid           uint32
30
  Comm          string
31
  Nr            uint32
32
  Syscall       string
33
  CallsPerSec   float64
34
  AvgLatUs      float64
35
  TotalMsPerSec float64 // 窗口内该 syscall 累计耗时(ms)/秒
36
  MaxLatUs      float64
37
}
38

39
// SyscallCollector 加载 syscall 热点场景的 eBPF 程序。
40
type SyscallCollector struct {
41
  objs  syscallObjects
42
  links []link.Link
43
  prev  map[scKey]scStat
44
}
45

46
// NewSyscallCollector 加载字节码、挂载 raw_syscalls tracepoint。
47
func NewSyscallCollector() (*SyscallCollector, error) {
48
  if err := rlimit.RemoveMemlock(); err != nil {
49
    return nil, fmt.Errorf("remove memlock: %w", err)
50
  }
51
  c := &SyscallCollector{prev: make(map[scKey]scStat)}
52
  if err := loadSyscallObjects(&c.objs, nil); err != nil {
53
    return nil, fmt.Errorf("load bpf objects: %w", err)
54
  }
55
  en, err := link.Tracepoint("raw_syscalls", "sys_enter", c.objs.HandleEnter, nil)
56
  if err != nil {
57
    c.Close()
58
    return nil, fmt.Errorf("attach sys_enter: %w", err)
59
  }
60
  c.links = append(c.links, en)
61

62
  ex, err := link.Tracepoint("raw_syscalls", "sys_exit", c.objs.HandleExit, nil)
63
  if err != nil {
64
    c.Close()
65
    return nil, fmt.Errorf("attach sys_exit: %w", err)
66
  }
67
  c.links = append(c.links, ex)
68
  return c, nil
69
}
70

71
// Close 卸载探针并释放资源。
72
func (c *SyscallCollector) Close() {
73
  for _, l := range c.links {
74
    _ = l.Close()
75
  }
76
  c.objs.Close()
77
}
78

79
// Poll 读取 syscall_stats，计算自上次调用以来的差分。
80
func (c *SyscallCollector) Poll(interval time.Duration) ([]SyscallSample, error) {
81
  cur := make(map[scKey]scStat)
82
  var key scKey
83
  var val scStat
84
  it := c.objs.SyscallStats.Iterate()
85
  for it.Next(&key, &val) {
86
    cur[key] = val
87
  }
88
  if err := it.Err(); err != nil {
89
    return nil, fmt.Errorf("iterate syscall_stats: %w", err)
90
  }
91

92
  secs := interval.Seconds()
93
  var samples []SyscallSample
94
  for k, v := range cur {
95
    p := c.prev[k]
96
    dCount := v.Count - p.Count
97
    dTotal := v.TotalNs - p.TotalNs
98
    if dCount == 0 {
99
      continue
100
    }
101
    s := SyscallSample{
102
      Pid:      k.Pid,
103
      Comm:     commToString(v.Comm),
104
      Nr:       k.Nr,
105
      Syscall:  syscalls.Name(k.Nr),
106
      MaxLatUs: float64(v.MaxNs) / 1000.0,
107
    }
108
    if secs > 0 {
109
      s.CallsPerSec = float64(dCount) / secs
110
      s.TotalMsPerSec = float64(dTotal) / secs / 1e6
111
    }
112
    s.AvgLatUs = float64(dTotal) / float64(dCount) / 1000.0
113
    samples = append(samples, s)
114
  }
115
  c.prev = cur
116
  return samples, nil
117
}