From 548228748f8513bc60924831546ff01c554b066b Mon Sep 17 00:00:00 2001 From: "Eric D. Schabell" Date: Tue, 7 Jul 2026 22:21:28 +0100 Subject: [PATCH] docs: pipeline: inputs: ebpf: document OpenSSL trace and event_id field - Document the trace_openssl trace, including the openssl_tls_read, openssl_tls_write, openssl_tls_shutdown, and openssl_tls_handshake operations and their ssl_ptr, latency_ns, and ret fields. - Add trace_openssl to the trace parameter list and the tls_* values to the event_type field. - Document the new per-CPU monotonic event_id common field emitted on every trace record. Note this update due to code change without matching docs PR. Signed-off-by: Eric D. Schabell --- pipeline/inputs/ebpf.md | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/pipeline/inputs/ebpf.md b/pipeline/inputs/ebpf.md index 49f3d9280..5f34e6c86 100644 --- a/pipeline/inputs/ebpf.md +++ b/pipeline/inputs/ebpf.md @@ -20,7 +20,7 @@ The plugin supports the following configuration parameters: |:----|:------------|:--------| | `poll_ms` | Set the polling interval in milliseconds for collecting events from the ring buffer. | `1000` | | `ringbuf_map_name` | Set the name of the eBPF ring buffer map to read events from. | `events` | -| `trace` | Set the eBPF trace to enable (for example, `trace_bind`, `trace_dns`, `trace_exec`, `trace_malloc`, `trace_sched`, `trace_signal`, `trace_tcp`, `trace_vfs`). This parameter can be set multiple times to enable multiple traces. | _none_ | +| `trace` | Set the eBPF trace to enable (for example, `trace_bind`, `trace_dns`, `trace_exec`, `trace_malloc`, `trace_openssl`, `trace_sched`, `trace_signal`, `trace_tcp`, `trace_vfs`). This parameter can be set multiple times to enable multiple traces. | _none_ | ## System dependencies @@ -130,7 +130,8 @@ All traces include the following fields: | Field | Description | |:------|:------------| -| `event_type` | Type of event (`signal`, `malloc`, `bind`, `exec`, `tcp`, or `vfs`). | +| `event_type` | Type of event (`signal`, `malloc`, `bind`, `exec`, `tcp`, `vfs`, `tls_handshake`, `tls_read`, `tls_write`, or `tls_shutdown`). | +| `event_id` | Per-CPU monotonic identifier for the event. | | `pid` | Process ID that generated the event. | | `tid` | Thread ID that generated the event. | | `comm` | Command name (process name) that generated the event. | @@ -239,3 +240,14 @@ The `trace_sched` trace captures CPU scheduling switch events and includes these | `next_prio` | Priority of the task being scheduled in. | | `runq_latency_ns` | Run-queue latency in nanoseconds between `wakeup` and scheduling in (`0` when not tracked). | | `wakeup_tracked` | Set to `true` when a matching `wakeup` was tracked for the run-queue latency calculation. | + +### OpenSSL trace fields + +The `trace_openssl` trace captures OpenSSL TLS operations using user-space probes and includes these additional fields: + +| Field | Description | +|:------|:------------| +| `trace` | OpenSSL operation. One of `openssl_tls_read`, `openssl_tls_write`, `openssl_tls_shutdown`, or `openssl_tls_handshake`. | +| `ssl_ptr` | Pointer to the OpenSSL `SSL` object associated with the operation. | +| `latency_ns` | Operation latency in nanoseconds. | +| `ret` | Return value of the OpenSSL call. |