From 20ea0f43feb368bdb47f455912839b8596f7101d Mon Sep 17 00:00:00 2001 From: Bertrone Matteo Date: Mon, 3 Aug 2026 17:29:17 +0200 Subject: [PATCH 1/2] fix(gpu): gate the event monitor on enable_ebpf_probes The event monitor is only used to feed the GPU monitoring eBPF probes with process exec/exit events, but both the system-probe module gate and the consumer creation were keyed on gpu_monitoring.enabled alone. A host running GPU monitoring through NVML only therefore still loaded the event monitor's eBPF programs and built a process consumer that nothing read. Gate both on gpu_monitoring.enable_ebpf_probes as well. The two have to move together to stay consistent with the EnableEBPFProbes && processEventConsumer == nil guard in the GPU module factory. The GPU module itself is still gated on gpu_monitoring.enabled, so NVML-based collection is unaffected. Co-Authored-By: Claude Opus 5 --- cmd/system-probe/modules/eventmonitor.go | 6 +++++- pkg/system-probe/config/config.go | 5 ++++- pkg/system-probe/config/config_test.go | 10 +++++++++- ...-monitor-gated-on-ebpf-probes-8935138775ed9a76.yaml | 7 +++++++ 4 files changed, 25 insertions(+), 3 deletions(-) create mode 100644 releasenotes/notes/gpu-event-monitor-gated-on-ebpf-probes-8935138775ed9a76.yaml diff --git a/cmd/system-probe/modules/eventmonitor.go b/cmd/system-probe/modules/eventmonitor.go index e38b237c74f3..132be172b733 100644 --- a/cmd/system-probe/modules/eventmonitor.go +++ b/cmd/system-probe/modules/eventmonitor.go @@ -133,7 +133,11 @@ func createEventMonitorModule(_ *sysconfigtypes.Config, deps module.FactoryDepen } gpucfg := gpuconfig.New() - if gpucfg.Enabled { + // Only the eBPF probes consume these events, so skip the consumer entirely + // when they are disabled. Kept in sync with the module gate in + // pkg/system-probe/config, which does not enable the event monitor for GPU + // monitoring unless the probes are enabled too. + if gpucfg.Enabled && gpucfg.EnableEBPFProbes { err := createGPUProcessEventConsumer(evm) if err != nil { return nil, fmt.Errorf("cannot create event consumer for GPU: %w", err) diff --git a/pkg/system-probe/config/config.go b/pkg/system-probe/config/config.go index dc6bd31461a7..f90a835eb5dd 100644 --- a/pkg/system-probe/config/config.go +++ b/pkg/system-probe/config/config.go @@ -126,6 +126,9 @@ func load() (*types.Config, error) { eudmEnabled := coreCfg.GetString("infrastructure_mode") == "end_user_device" csmEnabled := cfg.GetBool(secNS("enabled")) gpuEnabled := cfg.GetBool(gpuNS("enabled")) + // The GPU module only consumes process events when its eBPF probes are + // loaded, so the event monitor is only needed for that combination. + gpuEBPFProbesEnabled := gpuEnabled && cfg.GetBool(gpuNS("enable_ebpf_probes")) diEnabled := cfg.GetBool(diNS("enabled")) swEnabled := coreCfg.GetBool(swNS("enabled")) discoveryServiceMapEnabled := cfg.GetBool(discoveryNS("service_map", "enabled")) @@ -144,7 +147,7 @@ func load() (*types.Config, error) { coreCfg.GetBool("sbom.enrichment.usage.enabled") || (usmEnabled && cfg.GetBool(smNS("enable_event_stream"))) || (c.ModuleIsEnabled(NetworkTracerModule) && cfg.GetBool(evNS("network_process.enabled"))) || - gpuEnabled || + gpuEBPFProbesEnabled || diEnabled { c.EnabledModules[EventMonitorModule] = struct{}{} } diff --git a/pkg/system-probe/config/config_test.go b/pkg/system-probe/config/config_test.go index 52dcd63b62fa..ff482fa4b4f6 100644 --- a/pkg/system-probe/config/config_test.go +++ b/pkg/system-probe/config/config_test.go @@ -23,6 +23,7 @@ func TestEventMonitor(t *testing.T) { for i, tc := range []struct { cws, fim, networkEvents, gpu bool + gpuEBPFProbes bool usmEvents bool enabled bool }{ @@ -34,7 +35,11 @@ func TestEventMonitor(t *testing.T) { {cws: false, fim: true, networkEvents: true, enabled: true}, {cws: true, fim: false, networkEvents: true, enabled: true}, {cws: true, fim: true, networkEvents: true, enabled: true}, - {cws: false, fim: false, networkEvents: false, gpu: true, enabled: true}, + // GPU monitoring only needs the event monitor to feed its eBPF probes, + // so both settings have to be enabled for the module to be pulled in. + {cws: false, fim: false, networkEvents: false, gpu: true, gpuEBPFProbes: true, enabled: true}, + {cws: false, fim: false, networkEvents: false, gpu: true, gpuEBPFProbes: false, enabled: false}, + {cws: false, fim: false, networkEvents: false, gpu: false, gpuEBPFProbes: true, enabled: false}, {usmEvents: true, enabled: true}, } { t.Run(strconv.Itoa(i), func(t *testing.T) { @@ -44,6 +49,9 @@ func TestEventMonitor(t *testing.T) { t.Setenv("DD_SYSTEM_PROBE_EVENT_MONITORING_NETWORK_PROCESS_ENABLED", strconv.FormatBool(tc.networkEvents)) t.Setenv("DD_SYSTEM_PROBE_NETWORK_ENABLED", strconv.FormatBool(tc.networkEvents)) t.Setenv("DD_GPU_MONITORING_ENABLED", strconv.FormatBool(tc.gpu)) + // Set explicitly rather than relying on the default, which is + // subject to change as the eBPF probes are deprecated. + t.Setenv("DD_GPU_MONITORING_ENABLE_EBPF_PROBES", strconv.FormatBool(tc.gpuEBPFProbes)) t.Setenv("DD_SYSTEM_PROBE_SERVICE_MONITORING_ENABLED", strconv.FormatBool(tc.usmEvents)) t.Setenv("DD_SERVICE_MONITORING_CONFIG_ENABLE_EVENT_STREAM", strconv.FormatBool(tc.usmEvents)) diff --git a/releasenotes/notes/gpu-event-monitor-gated-on-ebpf-probes-8935138775ed9a76.yaml b/releasenotes/notes/gpu-event-monitor-gated-on-ebpf-probes-8935138775ed9a76.yaml new file mode 100644 index 000000000000..16484c58a00b --- /dev/null +++ b/releasenotes/notes/gpu-event-monitor-gated-on-ebpf-probes-8935138775ed9a76.yaml @@ -0,0 +1,7 @@ +--- +enhancements: + - | + GPU Monitoring no longer starts the system-probe event monitor when + ``gpu_monitoring.enable_ebpf_probes`` is disabled, as only the eBPF probes + consume its process events. Hosts running GPU Monitoring through NVML alone + no longer load the event monitor's eBPF programs. From b75f16055258ed7d8e005ca9a2186a727ceccf94 Mon Sep 17 00:00:00 2001 From: Bertrone Matteo Date: Tue, 4 Aug 2026 13:33:18 +0200 Subject: [PATCH 2/2] rm release note not needed --- ...vent-monitor-gated-on-ebpf-probes-8935138775ed9a76.yaml | 7 ------- 1 file changed, 7 deletions(-) delete mode 100644 releasenotes/notes/gpu-event-monitor-gated-on-ebpf-probes-8935138775ed9a76.yaml diff --git a/releasenotes/notes/gpu-event-monitor-gated-on-ebpf-probes-8935138775ed9a76.yaml b/releasenotes/notes/gpu-event-monitor-gated-on-ebpf-probes-8935138775ed9a76.yaml deleted file mode 100644 index 16484c58a00b..000000000000 --- a/releasenotes/notes/gpu-event-monitor-gated-on-ebpf-probes-8935138775ed9a76.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -enhancements: - - | - GPU Monitoring no longer starts the system-probe event monitor when - ``gpu_monitoring.enable_ebpf_probes`` is disabled, as only the eBPF probes - consume its process events. Hosts running GPU Monitoring through NVML alone - no longer load the event monitor's eBPF programs.