Documentation
¶
Overview ¶
Package probes attaches paired entry/exit uprobes declared in a YAML config to user-space binaries observed by the agent and streams scope-duration events to the configured remote-store as OTLP logs.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ProbeSpec ¶
type ProbeSpec struct {
SpecID uint32
ID string
FileMatch string
FileMatchRE *regexp.Regexp
EntrySymbol string
ExitSymbol string
MainThreadOnly bool
MinDurationMs uint32
}
ProbeSpec is one entry parsed from the probe-config YAML, augmented with a 1-based spec_id assigned at parse time. Each spec describes a paired entry/exit uprobe pair whose duration is measured in BPF.
func LoadConfig ¶
LoadConfig reads and parses a probe-config YAML file. Required fields per entry: `id`, `file_match`, `entry_symbol`, `exit_symbol`. Defaults: main_thread_only=true, min_duration_ms=0.
`file_match` is usually matched against the executable's absolute path (from args.Mapping.Path), but for cache catch-up and any code path where the absolute path is unavailable, the executable's basename is used as a fallback. Probe regexes should accept either form, e.g. `(^|/)node$`.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service owns the BPF programs, the attach worker, and the ringbuf drain loop. Drained events are emitted as OTel spans via the Tracer handed out by reporter.ParcaReporter; the reporter owns the underlying OTLP pipeline (queue, batch, retry, transport). Construct with Start, tear down with Close.
func Start ¶
func Start(ctx context.Context, cfg StartConfig, rep reporter.ParcaReporter) (*Service, error)
Start parses the YAML, loads the BPF programs, and spawns the drain and attach goroutines. It does NOT attach any uprobes yet -- those happen as OnExecutable is invoked by the profiler for each newly-observed binary.
func (*Service) Close ¶
Close cancels the service's root context, waits for goroutines to drain, closes attached uprobe links, and releases BPF resources.
Closing the ringbuf reader is required BEFORE waiting on the WaitGroup: the drain goroutine is parked inside reader.Read(), which only returns when an event arrives or the reader is closed. The drain loop's ctx.Done check at the top of each iteration never gets revisited while Read is blocked, so cancelling the context alone is not enough to unblock it. Closing the reader makes Read return; the drain loop then sees the already-cancelled context and exits.
type StartConfig ¶
type StartConfig struct {
ConfigPath string // path to probe-config YAML; required
}
StartConfig is the small bag of parameters Service.Start needs in addition to the YAML probe-config path.
Source Files