Katyusha's blog

1
package detector
2

3
import (
4
  "time"
5

6
  "github.com/os2026/ebpf-rca/internal/collector"
7
)
8

9
// LockSignal 表示一次已确认的锁竞争/长阻塞异常。
10
type LockSignal struct {
11
  Sample      collector.LockSample
12
  WindowStart time.Time
13
  WindowEnd   time.Time
14
}
15

16
// LockDetector 检测持续高 off-CPU 阻塞占比的线程。
17
type LockDetector struct {
18
  Threshold    float64 // off-CPU 阻塞占比阈值(0..1)
19
  SustainTicks int
20
  counters     map[uint32]int
21
  firstSeen    map[uint32]time.Time
22
  fired        map[uint32]bool
23
}
24

25
// NewLockDetector 构造检测器。
26
func NewLockDetector(threshold float64, sustain int) *LockDetector {
27
  if sustain < 1 {
28
    sustain = 1
29
  }
30
  return &LockDetector{
31
    Threshold:    threshold,
32
    SustainTicks: sustain,
33
    counters:     make(map[uint32]int),
34
    firstSeen:    make(map[uint32]time.Time),
35
    fired:        make(map[uint32]bool),
36
  }
37
}
38

39
// Detect 处理一个窗口的样本，返回本窗口新触发的异常信号。
40
func (d *LockDetector) Detect(samples []collector.LockSample, now time.Time) []LockSignal {
41
  active := make(map[uint32]bool, len(samples))
42
  var signals []LockSignal
43

44
  for _, s := range samples {
45
    if s.OffcpuRatio < d.Threshold {
46
      continue
47
    }
48
    active[s.Pid] = true
49
    if d.counters[s.Pid] == 0 {
50
      d.firstSeen[s.Pid] = now
51
    }
52
    d.counters[s.Pid]++
53
    if d.counters[s.Pid] >= d.SustainTicks && !d.fired[s.Pid] {
54
      d.fired[s.Pid] = true
55
      signals = append(signals, LockSignal{
56
        Sample:      s,
57
        WindowStart: d.firstSeen[s.Pid],
58
        WindowEnd:   now,
59
      })
60
    }
61
  }
62

63
  for pid := range d.counters {
64
    if !active[pid] {
65
      delete(d.counters, pid)
66
      delete(d.firstSeen, pid)
67
      delete(d.fired, pid)
68
    }
69
  }
70
  return signals
71
}