From e99db64db4bbe7bec233aea6feffac04eb478ab3 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Thu, 25 Jun 2026 14:22:29 +0900 Subject: [PATCH] in_ebpf: Add per cpu monotonic event ID Signed-off-by: Hiroshi Hatake --- plugins/in_ebpf/traces/bind/bpf.c | 2 ++ plugins/in_ebpf/traces/dns/bpf.c | 2 ++ plugins/in_ebpf/traces/exec/bpf.c | 2 ++ .../in_ebpf/traces/includes/common/encoder.h | 10 +++++++ .../traces/includes/common/event_id.bpf.h | 27 +++++++++++++++++++ .../in_ebpf/traces/includes/common/events.h | 1 + plugins/in_ebpf/traces/malloc/bpf.c.in | 3 +++ plugins/in_ebpf/traces/openssl/bpf.c.in | 2 ++ plugins/in_ebpf/traces/sched/bpf.c | 2 ++ plugins/in_ebpf/traces/signal/bpf.c | 3 +++ plugins/in_ebpf/traces/tcp/bpf.c | 2 ++ plugins/in_ebpf/traces/vfs/bpf.c | 2 ++ 12 files changed, 58 insertions(+) create mode 100644 plugins/in_ebpf/traces/includes/common/event_id.bpf.h diff --git a/plugins/in_ebpf/traces/bind/bpf.c b/plugins/in_ebpf/traces/bind/bpf.c index 1712bf67ec7..fd7b42d5aa4 100644 --- a/plugins/in_ebpf/traces/bind/bpf.c +++ b/plugins/in_ebpf/traces/bind/bpf.c @@ -20,6 +20,7 @@ #include #include "common/events.h" +#include "common/event_id.bpf.h" #define MAX_ENTRIES 10240 @@ -75,6 +76,7 @@ static int handle_bind_exit(struct pt_regs *ctx, short ver) { event->common.gid = (u32)(uid_gid >> 32); event->common.mntns_id = mntns_id; event->type = EVENT_TYPE_BIND; + generate_event_id(&event->common.event_id); event->common.timestamp_raw = bpf_ktime_get_boot_ns(); bpf_get_current_comm(&event->common.comm, sizeof(event->common.comm)); diff --git a/plugins/in_ebpf/traces/dns/bpf.c b/plugins/in_ebpf/traces/dns/bpf.c index 9a944bec35d..3d9187e8fce 100644 --- a/plugins/in_ebpf/traces/dns/bpf.c +++ b/plugins/in_ebpf/traces/dns/bpf.c @@ -14,6 +14,7 @@ #include #include "common/events.h" +#include "common/event_id.bpf.h" #ifndef AF_INET #define AF_INET 2 @@ -96,6 +97,7 @@ static __always_inline void fill_common(struct event *event, __u64 mntns_id) pid_tgid = bpf_get_current_pid_tgid(); uid_gid = bpf_get_current_uid_gid(); + generate_event_id(&event->common.event_id); event->common.timestamp_raw = bpf_ktime_get_boot_ns(); event->common.pid = (__u32) (pid_tgid >> 32); event->common.tid = (__u32) pid_tgid; diff --git a/plugins/in_ebpf/traces/exec/bpf.c b/plugins/in_ebpf/traces/exec/bpf.c index 21b6dec524b..0c9326f4e67 100644 --- a/plugins/in_ebpf/traces/exec/bpf.c +++ b/plugins/in_ebpf/traces/exec/bpf.c @@ -14,6 +14,7 @@ #include #include "common/events.h" +#include "common/event_id.bpf.h" #define MAX_ENTRIES 10240 #define ARGV_MAX_SCAN 20 @@ -71,6 +72,7 @@ static __always_inline int submit_exec_event(void *ctx, pid_tgid = bpf_get_current_pid_tgid(); uid_gid = bpf_get_current_uid_gid(); + generate_event_id(&event->common.event_id); event->common.timestamp_raw = bpf_ktime_get_boot_ns(); event->common.pid = (__u32) (pid_tgid >> 32); event->common.tid = (__u32) pid_tgid; diff --git a/plugins/in_ebpf/traces/includes/common/encoder.h b/plugins/in_ebpf/traces/includes/common/encoder.h index e8c2acb033e..5674c4a26ff 100644 --- a/plugins/in_ebpf/traces/includes/common/encoder.h +++ b/plugins/in_ebpf/traces/includes/common/encoder.h @@ -66,6 +66,16 @@ static inline int encode_common_fields(struct flb_log_event_encoder *log_encoder return -1; } + /* Encode event ID */ + ret = flb_log_event_encoder_append_body_cstring(log_encoder, "event_id"); + if (ret != FLB_EVENT_ENCODER_SUCCESS) { + return -1; + } + ret = flb_log_event_encoder_append_body_uint64(log_encoder, e->common.event_id); + if (ret != FLB_EVENT_ENCODER_SUCCESS) { + return -1; + } + /* Encode process ID */ ret = flb_log_event_encoder_append_body_cstring(log_encoder, "pid"); if (ret != FLB_EVENT_ENCODER_SUCCESS) { diff --git a/plugins/in_ebpf/traces/includes/common/event_id.bpf.h b/plugins/in_ebpf/traces/includes/common/event_id.bpf.h new file mode 100644 index 00000000000..77afbcd8ceb --- /dev/null +++ b/plugins/in_ebpf/traces/includes/common/event_id.bpf.h @@ -0,0 +1,27 @@ +#ifndef EBPF_EVENT_ID_H +#define EBPF_EVENT_ID_H + +#include + +struct { + __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); + __type(key, __u32); + __type(value, __u64); + __uint(max_entries, 1); +} seq_counter SEC(".maps"); + +static __always_inline void generate_event_id(__u64 *event_id) +{ + __u32 key = 0; + __u64 *counter = bpf_map_lookup_elem(&seq_counter, &key); + if (counter) { + /* ID is CPU shifted left by 48 bits, OR'd with per-CPU counter */ + *event_id = ((__u64)bpf_get_smp_processor_id() << 48) | (*counter); + (*counter)++; + } + else { + *event_id = 0; + } +} + +#endif /* EBPF_EVENT_ID_H */ diff --git a/plugins/in_ebpf/traces/includes/common/events.h b/plugins/in_ebpf/traces/includes/common/events.h index 7baa73d822d..6f84b9571a4 100644 --- a/plugins/in_ebpf/traces/includes/common/events.h +++ b/plugins/in_ebpf/traces/includes/common/events.h @@ -49,6 +49,7 @@ enum memop { }; struct event_common { + __u64 event_id; __u64 timestamp_raw; __u32 pid; __u32 tid; diff --git a/plugins/in_ebpf/traces/malloc/bpf.c.in b/plugins/in_ebpf/traces/malloc/bpf.c.in index c37d3952a20..420da823d32 100644 --- a/plugins/in_ebpf/traces/malloc/bpf.c.in +++ b/plugins/in_ebpf/traces/malloc/bpf.c.in @@ -15,6 +15,7 @@ #include #include "common/events.h" +#include "common/event_id.bpf.h" #define MAX_ENTRIES 10240 @@ -72,6 +73,7 @@ static int gen_alloc_exit(struct pt_regs *ctx, enum memop op, u64 addr) { u64 uid_gid = bpf_get_current_uid_gid(); + generate_event_id(&eventp->common.event_id); eventp->common.timestamp_raw = bpf_ktime_get_ns(); eventp->common.pid = tid >> 32; eventp->common.tid = tid; @@ -102,6 +104,7 @@ static int gen_free_enter(struct pt_regs *ctx, enum memop op, u64 addr) { u32 tid = (u32)bpf_get_current_pid_tgid(); + generate_event_id(&eventp->common.event_id); eventp->common.timestamp_raw = bpf_ktime_get_ns(); eventp->common.pid = tid >> 32; eventp->common.tid = tid; diff --git a/plugins/in_ebpf/traces/openssl/bpf.c.in b/plugins/in_ebpf/traces/openssl/bpf.c.in index c1538c91123..983cee2409b 100644 --- a/plugins/in_ebpf/traces/openssl/bpf.c.in +++ b/plugins/in_ebpf/traces/openssl/bpf.c.in @@ -18,6 +18,7 @@ #include #include "common/events.h" +#include "common/event_id.bpf.h" #define MAX_ENTRIES 10240 @@ -50,6 +51,7 @@ static __always_inline void fill_common(struct event *event) pid_tgid = bpf_get_current_pid_tgid(); uid_gid = bpf_get_current_uid_gid(); + generate_event_id(&event->common.event_id); event->common.timestamp_raw = bpf_ktime_get_boot_ns(); event->common.pid = (__u32) (pid_tgid >> 32); event->common.tid = (__u32) pid_tgid; diff --git a/plugins/in_ebpf/traces/sched/bpf.c b/plugins/in_ebpf/traces/sched/bpf.c index 56ded2fe389..db404c7feaf 100644 --- a/plugins/in_ebpf/traces/sched/bpf.c +++ b/plugins/in_ebpf/traces/sched/bpf.c @@ -14,6 +14,7 @@ #include #include "common/events.h" +#include "common/event_id.bpf.h" struct wakeup_info { __u64 wakeup_ns; @@ -102,6 +103,7 @@ int BPF_PROG(trace_sched_switch, bool preempt, struct task_struct *prev, } event->type = EVENT_TYPE_SCHED; + generate_event_id(&event->common.event_id); event->common.timestamp_raw = bpf_ktime_get_boot_ns(); event->common.pid = next_pid; event->common.tid = next_tid; diff --git a/plugins/in_ebpf/traces/signal/bpf.c b/plugins/in_ebpf/traces/signal/bpf.c index 7d4503c220d..b5c30c76942 100644 --- a/plugins/in_ebpf/traces/signal/bpf.c +++ b/plugins/in_ebpf/traces/signal/bpf.c @@ -16,6 +16,7 @@ #include #include "common/events.h" +#include "common/event_id.bpf.h" struct value { @@ -81,6 +82,7 @@ static int handle_signal_exit(void *ctx, int ret) { return 0; /* Populate the event with data */ + generate_event_id(&eventp->common.event_id); eventp->common.timestamp_raw = bpf_ktime_get_boot_ns(); eventp->common.pid = pid_tgid >> 32; eventp->common.tid = tid; @@ -167,6 +169,7 @@ int ig_sig_generate(struct trace_event_raw_signal_generate *ctx) { return 0; /* Populate the event with data */ + generate_event_id(&event->common.event_id); event->common.timestamp_raw = bpf_ktime_get_boot_ns(); event->common.pid = pid; event->common.tid = (__u32)pid_tgid; diff --git a/plugins/in_ebpf/traces/tcp/bpf.c b/plugins/in_ebpf/traces/tcp/bpf.c index c5b39e452fd..c1312ba1ad8 100644 --- a/plugins/in_ebpf/traces/tcp/bpf.c +++ b/plugins/in_ebpf/traces/tcp/bpf.c @@ -15,6 +15,7 @@ #include #include "common/events.h" +#include "common/event_id.bpf.h" #ifndef AF_UNSPEC #define AF_UNSPEC 0 @@ -81,6 +82,7 @@ static __always_inline void fill_common(struct event *event, __u64 mntns_id) pid_tgid = bpf_get_current_pid_tgid(); uid_gid = bpf_get_current_uid_gid(); + generate_event_id(&event->common.event_id); event->common.timestamp_raw = bpf_ktime_get_boot_ns(); event->common.pid = (__u32) (pid_tgid >> 32); event->common.tid = (__u32) pid_tgid; diff --git a/plugins/in_ebpf/traces/vfs/bpf.c b/plugins/in_ebpf/traces/vfs/bpf.c index b77212d5f77..efa424e57f6 100644 --- a/plugins/in_ebpf/traces/vfs/bpf.c +++ b/plugins/in_ebpf/traces/vfs/bpf.c @@ -14,6 +14,7 @@ #include #include "common/events.h" +#include "common/event_id.bpf.h" #define MAX_ENTRIES 10240 @@ -87,6 +88,7 @@ int trace_vfs_openat_exit(struct syscall_trace_exit *ctx) uid_gid = bpf_get_current_uid_gid(); + generate_event_id(&event->common.event_id); event->common.timestamp_raw = bpf_ktime_get_boot_ns(); event->common.pid = pid_tgid >> 32; event->common.tid = tid;