Documentation
¶
Overview ¶
Package socketprobe attaches the socket probes that feed container RED metric aggregation and turns their ring buffer records into redmetrics.SocketEvent values.
The probes are four eBPF programs across three attach points: tcp_sendmsg, tcp_recvmsg on both entry and return, and tcp_close. They read addresses and ports off the socket structure, so no packet header is parsed, and they add no capability, host mount or kernel requirement beyond what the DaemonSet already has.
Only the loader is Linux-only. The record layout and its decoder live here so they can be tested anywhere.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrUnsupported = errors.New("socketprobe: socket probes require Linux")
ErrUnsupported is returned when the probes cannot run on this platform.
Functions ¶
This section is empty.
Types ¶
type Probe ¶
type Probe struct {
// contains filtered or unexported fields
}
Probe owns the loaded programs, their attachments and the ring buffer reader. Nothing is loaded or attached until Attach is called, so a disabled feature costs exactly nothing.
func (*Probe) Attach ¶
Attach loads the programs and attaches all of them. It is the only step that can fail for reasons specific to the running kernel, so callers report health from its error rather than from the read loop.
func (*Probe) Close ¶
Close detaches the programs and releases the ring buffer. It is safe to call on a probe that never attached.
func (*Probe) Run ¶
func (p *Probe) Run(ctx context.Context, sink func(redmetrics.SocketEvent)) error
Run reads events until the context is cancelled or the probe is closed, handing each decoded event to sink. Attach must have succeeded first.
Source Files