From 1d56375ae3d32f5db75543ff37b45323fd5690c6 Mon Sep 17 00:00:00 2001 From: "jo.perez" Date: Wed, 26 Jul 2023 14:20:09 +0200 Subject: [PATCH 1/2] feat: make kprobes optional through config By adding the socket.disable_kprobe object, it is possible to disable specific kprobes ny adding them as a member : . This is useful to tredeoff the CPU utilisation of servers with long living connections where loads of data are being transmitted and received. --- x-pack/auditbeat/module/system/socket/config.go | 3 +++ x-pack/auditbeat/module/system/socket/socket_linux.go | 7 ++++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/x-pack/auditbeat/module/system/socket/config.go b/x-pack/auditbeat/module/system/socket/config.go index 79413f7649cb..2260b7f060b0 100644 --- a/x-pack/auditbeat/module/system/socket/config.go +++ b/x-pack/auditbeat/module/system/socket/config.go @@ -65,6 +65,9 @@ type Config struct { // EnableIPv6 allows to control IPv6 support. When unset (default) IPv6 // will be automatically detected on runtime. EnableIPv6 *bool `config:"socket.enable_ipv6"` + + // DisableKprobe allows to disable specific kprobes by their probe name. + DisableKprobe map[string]bool `config:"socket.disable_kprobe"` } // Validate validates the socket metricset config. diff --git a/x-pack/auditbeat/module/system/socket/socket_linux.go b/x-pack/auditbeat/module/system/socket/socket_linux.go index 4cd4edf7a136..c62ff4fbd4f7 100644 --- a/x-pack/auditbeat/module/system/socket/socket_linux.go +++ b/x-pack/auditbeat/module/system/socket/socket_linux.go @@ -3,7 +3,6 @@ // you may not use this file except in compliance with the Elastic License. //go:build (linux && 386) || (linux && amd64) -// +build linux,386 linux,amd64 package socket @@ -405,6 +404,9 @@ func (m *MetricSet) Setup() (err error) { // Make sure all the required kernel functions are available // for _, probeDef := range getKProbes(hasIPv6) { + if disabled, ok := m.config.DisableKprobe[probeDef.Probe.Name]; ok && disabled { + continue + } probeDef = probeDef.ApplyTemplate(m.templateVars) name := probeDef.Probe.Address if !m.isKernelFunctionAvailable(name, functions) { @@ -454,6 +456,9 @@ func (m *MetricSet) Setup() (err error) { // Register Kprobes // for _, probeDef := range getKProbes(hasIPv6) { + if disabled, ok := m.config.DisableKprobe[probeDef.Probe.Name]; ok && disabled { + continue + } format, decoder, err := m.installer.Install(probeDef) if err != nil { return fmt.Errorf("unable to register probe %s: %w", probeDef.Probe.String(), err) From 5ebd28f80b2975e20f9484c9590a2b4c63acc593 Mon Sep 17 00:00:00 2001 From: "jo.perez" Date: Wed, 26 Jul 2023 14:20:09 +0200 Subject: [PATCH 2/2] feat: make kprobes optional through config By adding the socket.disable_kprobe object, it is possible to disable specific kprobes ny adding them as a member : . This is useful to tredeoff the CPU utilisation of servers with long living connections where loads of data are being transmitted and received. --- x-pack/auditbeat/module/system/socket/config.go | 2 +- x-pack/auditbeat/module/system/socket/socket_linux.go | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/x-pack/auditbeat/module/system/socket/config.go b/x-pack/auditbeat/module/system/socket/config.go index 2260b7f060b0..89f2e6806432 100644 --- a/x-pack/auditbeat/module/system/socket/config.go +++ b/x-pack/auditbeat/module/system/socket/config.go @@ -67,7 +67,7 @@ type Config struct { EnableIPv6 *bool `config:"socket.enable_ipv6"` // DisableKprobe allows to disable specific kprobes by their probe name. - DisableKprobe map[string]bool `config:"socket.disable_kprobe"` + DisableKprobe []string `config:"socket.disable_kprobe"` } // Validate validates the socket metricset config. diff --git a/x-pack/auditbeat/module/system/socket/socket_linux.go b/x-pack/auditbeat/module/system/socket/socket_linux.go index c62ff4fbd4f7..5baeff2f95d0 100644 --- a/x-pack/auditbeat/module/system/socket/socket_linux.go +++ b/x-pack/auditbeat/module/system/socket/socket_linux.go @@ -21,6 +21,7 @@ import ( "syscall" "time" + "golang.org/x/exp/slices" "golang.org/x/sys/unix" "github.com/elastic/beats/v7/libbeat/common" @@ -404,7 +405,7 @@ func (m *MetricSet) Setup() (err error) { // Make sure all the required kernel functions are available // for _, probeDef := range getKProbes(hasIPv6) { - if disabled, ok := m.config.DisableKprobe[probeDef.Probe.Name]; ok && disabled { + if slices.Index(m.config.DisableKprobe, probeDef.Probe.Name) != -1 { continue } probeDef = probeDef.ApplyTemplate(m.templateVars) @@ -456,7 +457,7 @@ func (m *MetricSet) Setup() (err error) { // Register Kprobes // for _, probeDef := range getKProbes(hasIPv6) { - if disabled, ok := m.config.DisableKprobe[probeDef.Probe.Name]; ok && disabled { + if slices.Index(m.config.DisableKprobe, probeDef.Probe.Name) != -1 { continue } format, decoder, err := m.installer.Install(probeDef)