Skip to content

feat: add InputNetworkObserver, InputProcessSecurity, InputNetworkSecurity eBPF plugins #2049

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 161 commits into from
Apr 18, 2025
Merged

feat: add InputNetworkObserver, InputProcessSecurity, InputNetworkSecurity eBPF plugins #2049

merged 161 commits into from
Apr 18, 2025
+28,528 −4,699

Conversation

KayzzzZ
Copy link
Collaborator

@KayzzzZ KayzzzZ commented Jan 19, 2025 •
edited by yyuuttaaoo
Loading

  1. 引入 coolbpf 子模块，作为 bpf 底座
  2. 新增 ebpf driver 目录，作为 coolbpf 的驱动
  3. AbstractManager 将负责管理每个 eBPF 插件，所有的 AbstractManagers 由 eBPFServer 管理
  4. EBPFAdapter 仍然负责与 eBPFDriver 交互，不过 EBPFServer 不再直接调用 EBPFAdapter，转而由 AbstractManager 来调用
  5. 整体包括三组线程：Poller 线程负责拉取 eBPF PerfBuffer；Handler 线程负责处理 eBPF 事件；Scheduler 线程负责定时将聚合后的数据写入到 ProcessQueue 中

KayzzzZ added 30 commits January 23, 2025 10:48
@KayzzzZ
add some utils
d6e1030
@KayzzzZ
add protocol parser and aggregator
04f6599
@KayzzzZ
1. add some third party utils
d4aafbd 
2. add sampler
3. add some ut
@KayzzzZ
update coolbpf and add driver layer framework
c290c30
@KayzzzZ
compile coolbpf and driver lib
feeb539
@KayzzzZ
export some functions for driver
b575f94
@KayzzzZ
network observer start done ..
ca8b008
@KayzzzZ
network observer support log scenario
bdd653d
@KayzzzZ
fix enterprise compile
a660ac8
@KayzzzZ
update
0186592
@KayzzzZ
move id allocator
e9b9297
@KayzzzZ
format && add some framework
96a4cca
@KayzzzZ
update
cf01f07
@KayzzzZ
update
58962e7
@KayzzzZ
update
b438364
@KayzzzZ
update
697b82c
@KayzzzZ
update
58ad778
@KayzzzZ
add aggregator ut and setup aggregator for networksecurity & filesecu…
497b097 
…rity
@KayzzzZ
add some annotations
fa8bee1
@KayzzzZ
add lock
6313b5e
@KayzzzZ
add data handler
0374e83
@KayzzzZ
update
08b5201
@KayzzzZ
update
cdf4ff3
@KayzzzZ
fix conflict
65cca2c
@KayzzzZ
update
3176f41
@KayzzzZ
flush span
978b903
@KayzzzZ
fix url path
4d15e92
@KayzzzZ
set to event tag instead of event group tag
0f916e7
@KayzzzZ
update
3545ec5
@KayzzzZ
clang format
10217de
KayzzzZ added 10 commits April 14, 2025 14:39
@KayzzzZ
update
be2f04a
@KayzzzZ
1. modify Mark logic
cbe16e6 
2. add KernelNanoTimeToUTC
3. modify signature for http parser
4. modify spanID/traceID in appRecord
@KayzzzZ
1. push span/metrics自监控指标下移到NetworkObserverManager中
bec742d 
2. timeDiff替换成 KernelTimeNanoToUTC方法
3. 移除Periodical Event，在Timer Event Execute方法中主动PushNextEvent
4. eBPF Driver 中定义错误码
5. 采集配置中移除测试相关的配置
6. span和stringview 目录结构移动到 common 目录下
@KayzzzZ
remove redundant codes
b84ef51
@KayzzzZ
clang format
1478df6
@KayzzzZ
polish
9e1afb8
@KayzzzZ
clang format
43b44b8
@KayzzzZ
fix ut
b6a6425
@KayzzzZ
modify err code
36a5e45
@KayzzzZ
fix ut
5443533
henryzhx8
henryzhx8 requested changes Apr 16, 2025
View reviewed changes
@yyuuttaaoo yyuuttaaoo added core Core feature feature New feature labels Apr 17, 2025
@yyuuttaaoo yyuuttaaoo added this to the v3.1 milestone Apr 17, 2025
@yyuuttaaoo yyuuttaaoo merged commit b347c55 into alibaba:main Apr 18, 2025
15 checks passed
@yyuuttaaoo yyuuttaaoo changed the title feat: add ebpf plugins feat: add InputNetworkObserver, InputProcessSecurity, InputNetworkSecurity eBPF plugins Apr 18, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@yyuuttaaoo yyuuttaaoo yyuuttaaoo approved these changes

@messixukejia messixukejia messixukejia approved these changes

@henryzhx8 henryzhx8 henryzhx8 approved these changes

Assignees
No one assigned
Labels
core Core feature feature New feature
Projects
None yet
Milestone
v3.1
Development

Successfully merging this pull request may close these issues.
4 participants
@KayzzzZ @yyuuttaaoo @messixukejia @henryzhx8