draft for collection

I am just collecting the open events with a filename. We do not have
closes so we cannot time things, but that is not the goal here. I
am also limiting to a container cgroup id instead of trying
to do a bunch of parsing of processes and getting confused with tid
tgid pid ppid and then the fact that the kernel pid != the pid we
understand.

Signed-off-by: vsoch <[email protected]>

Author: vsoch

README.md

@@ -54,23 +54,15 @@ kind create cluster --config ./kind-config.yaml
 For ebpf (that requires mounting the host) I recommend a cloud:
 
 ```bash
-NODES=2
-GOOGLE_PROJECT=myproject
+NODES=1
+GOOGLE_PROJECT=llnl-flux
 INSTANCE=h3-standard-88
-
-time gcloud container clusters create test-cluster  \
-   --threads-per-core=1  \   
-   --num-nodes=$NODES  \   
-   --machine-type=$INSTANCE  \
-   --placement-type=COMPACT  \   
-   --image-type=UBUNTU_CONTAINERD \
-   --region=us-central1-a     --project=${GOOGLE_PROJECT}
+time gcloud container clusters create test-cluster  --threads-per-core=1  --num-nodes=$NODES --machine-type=$INSTANCE  --placement-type=COMPACT --image-type=UBUNTU_CONTAINERD --region=us-central1-a --project=${GOOGLE_PROJECT}
 ```
 
 Finally, install the Flux Operator
 
 ```bash
-# Install the Flux Operator
 kubectl apply -f https://raw.githubusercontent.com/flux-framework/flux-operator/refs/heads/main/examples/dist/flux-operator.yaml
 ```
 

base-template/docker/bcc-sidecar/Dockerfile

@@ -48,6 +48,7 @@ RUN git clone -b v0.34.0 https://github.com/iovisor/bcc /usr/src/bcc && \
 
 # Set up environment for Python BCC tools (if needed)
 ENV PYTHONPATH=/usr/lib/python3/dist-packages
+COPY ./programs /opt/programs
 
 # Command to keep the container running
 CMD ["tail", "-f", "/dev/null"]

base-template/docker/bcc-sidecar/programs/open-close/ebpf-collect.c

@@ -7,9 +7,15 @@
 enum event_type { EVENT_OPEN = 0, EVENT_CLOSE = 1 };
 
 struct data_t {
-    u64 timestamp_ns; u32 pid; char comm[TASK_COMM_LEN_EBPF];
-    enum event_type type; char filename[MAX_FILENAME_LEN_EBPF];
-    int fd; int ret_val;
+    u64 timestamp_ns; 
+    u32 pid; 
+    u32 ppid;      
+    u64 cgroup_id;
+    char comm[TASK_COMM_LEN_EBPF];
+    enum event_type type; 
+    char filename[MAX_FILENAME_LEN_EBPF];
+    int fd; 
+    int ret_val;
 };
 BPF_RINGBUF_OUTPUT(events, 8);
 
@@ -89,12 +95,12 @@ int trace_openat_return_kretprobe(struct pt_regs *ctx) {
     event_data_ptr->timestamp_ns = bpf_ktime_get_ns();
     event_data_ptr->pid = id >> 32;
     bpf_get_current_comm(&event_data_ptr->comm, sizeof(event_data_ptr->comm));
-    event_data_ptr->comm[TASK_COMM_LEN_EBPF - 1] = '\0'; // CORRECTED
+    event_data_ptr->comm[TASK_COMM_LEN_EBPF - 1] = '\0';
     event_data_ptr->type = EVENT_OPEN;
     event_data_ptr->fd = ret_fd;
     event_data_ptr->ret_val = ret_fd;
     __builtin_memcpy(event_data_ptr->filename, temp_fn_ptr->fname, MAX_FILENAME_LEN_EBPF);
-    event_data_ptr->filename[MAX_FILENAME_LEN_EBPF - 1] = '\0'; // CORRECTED
+    event_data_ptr->filename[MAX_FILENAME_LEN_EBPF - 1] = '\0';
     events.ringbuf_submit(event_data_ptr, 0);
     open_filenames_map.delete(&id);
     return 0;
@@ -106,12 +112,25 @@ int trace_close_entry_kprobe(struct pt_regs *ctx, int fd_to_close) {
     if (!event_data_ptr) { return 0; }
     event_data_ptr->timestamp_ns = bpf_ktime_get_ns();
     event_data_ptr->pid = id >> 32;
+
+    // Read parent's TGID carefully
+    u64 cgroup_id = bpf_get_current_cgroup_id();
+    struct task_struct *real_parent_task = NULL;
+    struct task_struct *current_task = (struct task_struct *)bpf_get_current_task();    
+    int res = bpf_probe_read_kernel(&real_parent_task, sizeof(real_parent_task), &current_task->real_parent);
+    if (res == 0 && real_parent_task != NULL) { 
+        bpf_probe_read_kernel(&event_data_ptr->ppid, sizeof(event_data_ptr->ppid), &real_parent_task->tgid);
+    } else {
+        // Error or no parent found this way
+        event_data_ptr->ppid = 0; 
+    }
     bpf_get_current_comm(&event_data_ptr->comm, sizeof(event_data_ptr->comm));
-    event_data_ptr->comm[TASK_COMM_LEN_EBPF - 1] = '\0'; // CORRECTED
+    event_data_ptr->comm[TASK_COMM_LEN_EBPF - 1] = '\0';
     event_data_ptr->type = EVENT_CLOSE;
     event_data_ptr->fd = fd_to_close;
-    event_data_ptr->filename[0] = '\0'; // CORRECTED
+    event_data_ptr->filename[0] = '\0';
     event_data_ptr->ret_val = 0;
+    event_data_ptr->cgroup_id = cgroup_id;
     events.ringbuf_submit(event_data_ptr, 0);
     return 0;
 }