Latest packages for BPF support This adds back bpf socket ev

Question

Latest packages for BPF support This adds back bpf socket events with listen accept accept4 socket and connect There are still no unit tests for this table so expect hidden bugs

CptOfEvilMinions · Answer

< alessandrogario> are these packages OS and version specific Will this run on ubuntu server 20 04

alessandrogario · Answer

They have been built with the osquery toolchain so they should be portable

CptOfEvilMinions · Answer

I download the ZIP provided and I installed Based on the PR and this Slack channel I ran the following command `sudo osqueryd S verbose enable bpf socket events enable bpf process events disable events=false` but received ```ubuntuvm tmp 20200929 osquery pr6571 bpf$ sudo osqueryd S verbose enable bpf socket events enable bpf process events disable events=false ERROR unknown command line flag enable bpf process events ERROR unknown command line flag enable bpf socket events ```

alessandrogario · Answer

aaargh I need to update the docs So since I need to trace all the syscalls regardless of which table the user wants to use i removed those flags

alessandrogario · Answer

the only flag required is enable bpf events

alessandrogario · Answer

There are some quirks with the openat openat2 syscall looks like you don t always have access to the memory you are required to read because those pages are not mapped I tried to add some workarounds to this but it may still throw some Malformed event for tracer x warnings

alessandrogario · Answer

Also there are no options yet to control how much memory to allocate in the ring buffers which would be helpful to increase when you know you are going to handle a certain number of events per minute

CptOfEvilMinions · Answer

I had an Ubuntu server 20 04 1 64 bit machine with 2GBs of memory and it was not enough

alessandrogario · Answer

Yeah it s the following settings inside bpfeventpublisher cpp ```const std size t kPerfEventArraySize 12U const std size t kBufferStorageSize 4096U const std size t kEventMapSize 2048 ``` kPerfEventArraySize = power of 2 determines how big the main ring buffer containing basic types is integers pointers process id uid Memory usage 2^kPerfEventArraySize cpu count kBufferStorageSize = how many slots of 4k bytes are allocated in each BufferStorage object 1 slot = 1 string example filename in open or buffer example sockaddr in connect Memory usage kBufferStorageSize 4k cpu count for each buffer storage we currently have 4 kEventMapSize memory map used to merge the enter tracepoint with the exit tracepoint Each slot is really small and its memory usage is low