-
Notifications
You must be signed in to change notification settings - Fork 179
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Processes name stop displaying after some time #312
Comments
This is because pwru fetches pid in kernel space while converts pid to process name in user space, so if the process sending skb is terminated before pwru starts the pid->pname convertion, no process can be found to match pid. Indeed we can fetch pname in bpf kernel space via Another easy fix is to cache pname in pwru user space during an skb's lifetime. |
Probably not worth the trade-off. If this happens only when the process is terminated early, then I'd say it's fine to miss info like the process name, rather than slow down the whole execution.
Sounds like a better option to me, for what it's worth. |
Any TL;DR how it would work? |
I was thinking using a user-space map[skb]pname to cache pname conversion, but that actually doesn't make sense because an skb could be transferred between processes (e.g. from a client process to a server process). Then I thought we could cache map[pid]pname, but the entry eviction is tricky, we should find an appropriate event to delete an pid->pname entry in map, instead of caching the entry forever. LRU? Timer? Tracing the lifetime of a process? |
Not sure about others, but TBH for me a process name is very little of use when debugging. |
LRU, don't evict, just read from the cache when you cannot get the pname from the regular conversion method?
Agreed it's nice to have, but not a big issue if it's occasionally broken |
I've got pwru log file that includes information on the processes that created the SKBs. At the beginning of the logs, the name and PID of the processes are displayed as expected. Starting with line 74415 (record 74414), the name of the processes that created the SKBs is no longer displayed, and shows as
<empty>
. The PID still shows up as expected.pwru.log
The text was updated successfully, but these errors were encountered: