ktm-ebpf

Overview

This repository provides the build pipeline and versioned outputs for the eBPF programs used by BanyanDB’s FODC/KTM pipeline.

The generated Go bindings and eBPF objects are consumed by BanyanDB as build-time artifacts.

Outputs

Generated artifacts live under iomonitor/ebpf/generated/:

• *_bpfel.go (Go bindings generated by bpf2go)
• *_bpfel.o (eBPF ELF objects)
• vmlinux.h (BTF-derived kernel types)

These files are intended to be checked in and consumed by BanyanDB.

Build & Test

Common commands:

• make install-deps installs clang/llvm/libbpf/bpftool.
• make generate or make ebpf-bindings builds Go bindings and eBPF objects.
• make test-ebpf runs eBPF tests (requires root).

Prerequisites:

• BTF enabled kernel (/sys/kernel/btf/vmlinux readable).
• tracefs or debugfs mounted for tracepoint attach.

Metrics Semantics

Metric interpretation is documented in ktm_metrics.md.
The key rule: incidents are gated on syscall-level read/pread latency; other signals are explanatory only.