`kprobe` programs compared to `raw_syscall` type bpf program
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 20/100
- Issue type
- Documentation
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- linux
- Domain
- devtools, operating-systems
Research direction
The issue names no repository files, tests, or entry points. Start by reading the Linux eBPF documentation on raw_tracepoint, kprobe, and kretprobe execution, then compare their argument handling and timing; done would be a documented, evidence-based answer to the performance question.
Written by the indexing model from the issue text.
Description
Hi, i'm new to ebpf and exploring how sysdig is using bpf. Sysdig is using raw_tracepoint type bpf programs to collect arguments and return values of different syscall functions. My understanding is, raw_tracepoint programs are faster because we can skip argument processing and get raw access to the arguments.
We can also collect these data using kprobe and kretprobe. My understanding is, these programs will be slower compared to raw_tracepoint programs as the are executed later in kernel and arguments are further processed.
My question is, even if we use raw_tracepoint programs, the kernel will eventually process the arguments and pass them to syscall functions, so kprobe programs should not be slower than raw_tracepoint programs, right?
Thanks!
- Dominant language
- C++
- Stars
- 8.3k
- Forks
- 753
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from draios/sysdig
-
Difficulty 4/5 3-5 days Newbie friendliness 52/100
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
difficulty-easy feature-request pinned
Difficulty 3/5 1-2 days Newbie friendliness 25/100
-
feature-request pinned
Difficulty 5/5 Over a week Newbie friendliness 25/100
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
AXERA-TECH/ax-llm#77 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
games-on-whales/wolf#509 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
bug-unconfirmed
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
NVIDIA/cuda-samples#453 ·