Fix the target pid of oomkill example, expose metrics by default (#91)

Author: krisztianfekete

examples/oomkill/README.md

@@ -40,12 +40,14 @@ bee run -f="exits,tcomm,bash" ghcr.io/solo-io/bumblebee/oomkill:$(bee version)
 
 Visualizing and alerting on oomkills is crucial, and Bumblebee can help you with that.
 
-You can modify your `oomkills` structure to generate a `counter` from the oomkill events:
+Since we have the `.counter` prefix added to our `oomkills` map, exposing the oomkill events as a `counter` metric is enabled by default:
 
 ```c
 struct {
         __uint(type, BPF_MAP_TYPE_RINGBUF);
         __uint(max_entries, 1 << 24);
         __type(value, struct data_t);
 } oomkills SEC(".maps.counter");
-```
+```
+
+To disable this functionality, you can change the suffix to `.print`.

examples/oomkill/oomkill.c

@@ -20,7 +20,7 @@ struct {
         __uint(type, BPF_MAP_TYPE_RINGBUF);
         __uint(max_entries, 1 << 24);
         __type(value, struct data_t);
-} oomkills SEC(".maps.print");
+} oomkills SEC(".maps.counter");
 
 SEC("kprobe/oom_kill_process")
 int BPF_KPROBE(oom_kill_process, struct oom_control *oc, const char *message)
@@ -32,7 +32,7 @@ int BPF_KPROBE(oom_kill_process, struct oom_control *oc, const char *message)
                 return 0;
         }
 
-        e->tpid = bpf_get_current_pid_tgid();
+        e->tpid = BPF_CORE_READ(oc, chosen, tgid);
         bpf_get_current_comm(&e->fcomm, TASK_COMM_LEN);
 
         e->fpid = bpf_get_current_pid_tgid() >> 32;
@@ -44,4 +44,4 @@ int BPF_KPROBE(oom_kill_process, struct oom_control *oc, const char *message)
         return 0;
 }
 
-char LICENSE[] SEC("license") = "GPL";
+char LICENSE[] SEC("license") = "GPL";