1
Go: NewCPUCollector()
2
  └─ bpf() syscall → 内核 verifier 静态检查字节码
3
  └─ 创建 3 个 map（oncpu_start, wakeup_ts, stats）
4
  └─ link.Tracepoint("sched", "sched_switch", handleSwitch)
5
  └─ link.Tracepoint("sched", "sched_wakeup", handleWakeup)

1
sched_switch 发生
2
  └─ handle_switch:
3
       prev 切出: run_ns 累加, ctx++（记录进程名）
4
       next 上 CPU: runq_ns 累加（结算排队时间）
5
       → 只做 O(1) 聚合，不判断，不发消息

1
Go: time.Ticker 触发
2
  └─ Poll(1s): 遍历 stats map → 差分 → 算 cpu_util / ctx_per_min / runq_wait
3
  └─ Detect: 阈值(0.9) + 连续窗口(3)判定异常
4
  └─ BuildCPUReport: 规则分类根因 + 组装证据链
5
  └─ output: JSON/YAML/Markdown

1
Ctrl-C → defer col.Close()
2
  └─ link.Close() → 从 tracepoint 摘除
3
  └─ objs.Close() → 释放 map 和程序 fd

1
sched_wakeup:
2
  wakeup_ts[tid] = now
3

4
sched_switch:
5
  prev 被切出:
6
    run_ns += now - oncpu_start[prev]
7
    ctx++
8
  next 上 CPU:
9
    oncpu_start[next] = now
10
    runq_ns += now - wakeup_ts[next]

1
CPUUtil    = delta(run_ns) / interval_ns
2
CtxPerMin  = delta(ctx) / interval_minutes
3
RunqWaitUs = delta(runq_ns) / delta(ctx) / 1000

1
mm_vmscan_direct_reclaim_begin:
2
  start[pid] = now
3

4
mm_vmscan_direct_reclaim_end:
5
  direct_reclaim_count++
6
  direct_reclaim_ns += now - start[pid]
7

8
mm_vmscan_kswapd_wake:
9
  kswapd_wakes++

1
MemAvailablePct < threshold
2
连续 sustain 窗口

1
sched_switch, prev_state != 0:
2
  offcpu_start[prev] = { now, stackid }
3

4
sched_switch, next 上 CPU:
5
  dur = now - offcpu_start[next]
6
  lock_stats[next].offcpu_ns += dur
7
  lock_stats[next].offcpu_count++
8

9
sched_wakeup:
10
  lock_stats[wakee].last_waker = current_tid

1
raw_syscalls:sys_enter:
2
  start[tid] = { now, syscall_nr }
3

4
raw_syscalls:sys_exit:
5
  dur = now - start[tid].ts
6
  syscall_stats[(tgid, nr)].count++
7
  syscall_stats[(tgid, nr)].total_ns += dur
8
  syscall_stats[(tgid, nr)].max_ns = max(max_ns, dur)  // best-effort

1
CallsPerSec    = delta(count) / interval
2
AvgLatUs       = delta(total_ns) / delta(count) / 1000
3
TotalMsPerSec  = delta(total_ns) / interval / 1e6

1
CallsPerSec >= threshold       // 默认 10000 次/秒
2
或 TotalMsPerSec >= 300         // 单个 syscall 每秒累计占用超过 300ms

1
用户态 write(fd, buf, len)
2
         |
3
         v
4
raw_syscalls:sys_enter         -> syscall 热点开始计时
5
         |
6
         | 可能缺页 / 分配页
7
         |   -> direct_reclaim_begin/end
8
         |
9
         | 可能提交块 I/O
10
         |   -> block_rq_issue
11
         |   -> block_rq_complete
12
         |
13
         | 可能等锁 / 等 I/O 睡眠
14
         |   -> sched_switch(prev_state != 0)
15
         |   -> sched_wakeup
16
         |
17
         | 调度切换穿插发生
18
         |   -> sched_switch 统计 CPU run_ns / ctx
19
         |
20
raw_syscalls:sys_exit          -> syscall 热点结算耗时
21
         |
22
         v
23
返回用户态

1
type handler func(schema.AnomalyReport)

1
ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
2
defer stop()

1
select {
2
case <-ctx.Done():
3
    return
4
case <-deadline:
5
    return
6
case now := <-ticker.C:
7
    tick(now)
8
}

1
case "syscall":
2
    err = runSyscall(ctx, cfg, h)

1
samples, err := col.Poll(cfg.interval)
2
for _, sig := range det.Detect(samples, now) {
3
    h(rca.BuildSyscallReport(sig))
4
}

1
Count   = 累计调用次数
2
TotalNs = 累计耗时
3
MaxNs   = 历史最大单次耗时

1
dCount := cur.Count - prev.Count
2
dTotal := cur.TotalNs - prev.TotalNs

1
calls_per_sec   = dCount / interval
2
avg_lat_us      = dTotal / dCount
3
total_ms_per_sec = dTotal / interval

1
_, _ = col.Poll(cfg.interval)

1
t0: eBPF 已挂载，map 开始累计
2
t0: Poll() 只建立 prev，丢弃样本
3
t1: ticker 触发，Poll() 得到 t0~t1 的差分
4
t2: ticker 触发，Poll() 得到 t1~t2 的差分