Skip to content

in_ebpf: Generate mostly monotonic event id for increasing traceability #12002

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
edsiper merged 1 commit into from
Jul 3, 2026
Merged

in_ebpf: Generate mostly monotonic event id for increasing traceability #12002

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions plugins/in_ebpf/traces/bind/bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@
#include <gadget/types.h>

#include "common/events.h"
#include "common/event_id.bpf.h"

#define MAX_ENTRIES 10240

Expand Down Expand Up @@ -75,6 +76,7 @@ static int handle_bind_exit(struct pt_regs *ctx, short ver) {
event->common.gid = (u32)(uid_gid >> 32);
event->common.mntns_id = mntns_id;
event->type = EVENT_TYPE_BIND;
generate_event_id(&event->common.event_id);
event->common.timestamp_raw = bpf_ktime_get_boot_ns();
bpf_get_current_comm(&event->common.comm, sizeof(event->common.comm));

Expand Down
2 changes: 2 additions & 0 deletions plugins/in_ebpf/traces/dns/bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
#include <gadget/types.h>

#include "common/events.h"
#include "common/event_id.bpf.h"

#ifndef AF_INET
#define AF_INET 2
Expand Down Expand Up @@ -96,6 +97,7 @@ static __always_inline void fill_common(struct event *event, __u64 mntns_id)
pid_tgid = bpf_get_current_pid_tgid();
uid_gid = bpf_get_current_uid_gid();

generate_event_id(&event->common.event_id);
event->common.timestamp_raw = bpf_ktime_get_boot_ns();
event->common.pid = (__u32) (pid_tgid >> 32);
event->common.tid = (__u32) pid_tgid;
Expand Down
2 changes: 2 additions & 0 deletions plugins/in_ebpf/traces/exec/bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
#include <gadget/types.h>

#include "common/events.h"
#include "common/event_id.bpf.h"

#define MAX_ENTRIES 10240
#define ARGV_MAX_SCAN 20
Expand Down Expand Up @@ -71,6 +72,7 @@ static __always_inline int submit_exec_event(void *ctx,
pid_tgid = bpf_get_current_pid_tgid();
uid_gid = bpf_get_current_uid_gid();

generate_event_id(&event->common.event_id);
event->common.timestamp_raw = bpf_ktime_get_boot_ns();
event->common.pid = (__u32) (pid_tgid >> 32);
event->common.tid = (__u32) pid_tgid;
Expand Down
10 changes: 10 additions & 0 deletions plugins/in_ebpf/traces/includes/common/encoder.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,16 @@ static inline int encode_common_fields(struct flb_log_event_encoder *log_encoder
return -1;
}

/* Encode event ID */
ret = flb_log_event_encoder_append_body_cstring(log_encoder, "event_id");
if (ret != FLB_EVENT_ENCODER_SUCCESS) {
return -1;
}
ret = flb_log_event_encoder_append_body_uint64(log_encoder, e->common.event_id);
if (ret != FLB_EVENT_ENCODER_SUCCESS) {
return -1;
}

/* Encode process ID */
ret = flb_log_event_encoder_append_body_cstring(log_encoder, "pid");
if (ret != FLB_EVENT_ENCODER_SUCCESS) {
Expand Down
27 changes: 27 additions & 0 deletions plugins/in_ebpf/traces/includes/common/event_id.bpf.h
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
#ifndef EBPF_EVENT_ID_H
#define EBPF_EVENT_ID_H

#include <bpf/bpf_helpers.h>

struct {
__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
__type(key, __u32);
__type(value, __u64);
__uint(max_entries, 1);
} seq_counter SEC(".maps");
Comment on lines +7 to +11

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Share event counters across trace objects

When the Trace option is set multiple times (plugins/in_ebpf/in_ebpf.c:263-265), each selected trace is compiled and loaded as its own BPF object, so defining seq_counter in this included header creates a separate counter map for every trace. That means the first event on CPU N from exec, tcp, dns, etc. all receive the same event_id (N << 48), so IDs collide in the combined event stream and cannot reliably trace event order across enabled traces; use a shared/pinned counter or include a trace/object component in the ID.

Useful? React with 👍 / 👎.


static __always_inline void generate_event_id(__u64 *event_id)
{
__u32 key = 0;
__u64 *counter = bpf_map_lookup_elem(&seq_counter, &key);
if (counter) {
/* ID is CPU shifted left by 48 bits, OR'd with per-CPU counter */
*event_id = ((__u64)bpf_get_smp_processor_id() << 48) | (*counter);
(*counter)++;
}
else {
*event_id = 0;
}
}

#endif /* EBPF_EVENT_ID_H */
1 change: 1 addition & 0 deletions plugins/in_ebpf/traces/includes/common/events.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@ enum memop {
};

struct event_common {
__u64 event_id;
__u64 timestamp_raw;
__u32 pid;
__u32 tid;
Expand Down
3 changes: 3 additions & 0 deletions plugins/in_ebpf/traces/malloc/bpf.c.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
#include <gadget/types.h>

#include "common/events.h"
#include "common/event_id.bpf.h"

#define MAX_ENTRIES 10240

Expand Down Expand Up @@ -72,6 +73,7 @@ static int gen_alloc_exit(struct pt_regs *ctx, enum memop op, u64 addr) {

u64 uid_gid = bpf_get_current_uid_gid();

generate_event_id(&eventp->common.event_id);
eventp->common.timestamp_raw = bpf_ktime_get_ns();
eventp->common.pid = tid >> 32;
eventp->common.tid = tid;
Expand Down Expand Up @@ -102,6 +104,7 @@ static int gen_free_enter(struct pt_regs *ctx, enum memop op, u64 addr) {

u32 tid = (u32)bpf_get_current_pid_tgid();

generate_event_id(&eventp->common.event_id);
eventp->common.timestamp_raw = bpf_ktime_get_ns();
eventp->common.pid = tid >> 32;
eventp->common.tid = tid;
Expand Down
2 changes: 2 additions & 0 deletions plugins/in_ebpf/traces/openssl/bpf.c.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@
#include <gadget/types.h>

#include "common/events.h"
#include "common/event_id.bpf.h"

#define MAX_ENTRIES 10240

Expand Down Expand Up @@ -50,6 +51,7 @@ static __always_inline void fill_common(struct event *event)
pid_tgid = bpf_get_current_pid_tgid();
uid_gid = bpf_get_current_uid_gid();

generate_event_id(&event->common.event_id);
event->common.timestamp_raw = bpf_ktime_get_boot_ns();
event->common.pid = (__u32) (pid_tgid >> 32);
event->common.tid = (__u32) pid_tgid;
Expand Down
2 changes: 2 additions & 0 deletions plugins/in_ebpf/traces/sched/bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
#include <gadget/mntns_filter.h>

#include "common/events.h"
#include "common/event_id.bpf.h"

struct wakeup_info {
__u64 wakeup_ns;
Expand Down Expand Up @@ -102,6 +103,7 @@ int BPF_PROG(trace_sched_switch, bool preempt, struct task_struct *prev,
}

event->type = EVENT_TYPE_SCHED;
generate_event_id(&event->common.event_id);
event->common.timestamp_raw = bpf_ktime_get_boot_ns();
event->common.pid = next_pid;
event->common.tid = next_tid;
Expand Down
3 changes: 3 additions & 0 deletions plugins/in_ebpf/traces/signal/bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@
#include <gadget/types.h>

#include "common/events.h"
#include "common/event_id.bpf.h"


struct value {
Expand Down Expand Up @@ -81,6 +82,7 @@ static int handle_signal_exit(void *ctx, int ret) {
return 0;

/* Populate the event with data */
generate_event_id(&eventp->common.event_id);
eventp->common.timestamp_raw = bpf_ktime_get_boot_ns();
eventp->common.pid = pid_tgid >> 32;
eventp->common.tid = tid;
Expand Down Expand Up @@ -167,6 +169,7 @@ int ig_sig_generate(struct trace_event_raw_signal_generate *ctx) {
return 0;

/* Populate the event with data */
generate_event_id(&event->common.event_id);
event->common.timestamp_raw = bpf_ktime_get_boot_ns();
event->common.pid = pid;
event->common.tid = (__u32)pid_tgid;
Expand Down
2 changes: 2 additions & 0 deletions plugins/in_ebpf/traces/tcp/bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
#include <gadget/types.h>

#include "common/events.h"
#include "common/event_id.bpf.h"

#ifndef AF_UNSPEC
#define AF_UNSPEC 0
Expand Down Expand Up @@ -81,6 +82,7 @@ static __always_inline void fill_common(struct event *event, __u64 mntns_id)
pid_tgid = bpf_get_current_pid_tgid();
uid_gid = bpf_get_current_uid_gid();

generate_event_id(&event->common.event_id);
event->common.timestamp_raw = bpf_ktime_get_boot_ns();
event->common.pid = (__u32) (pid_tgid >> 32);
event->common.tid = (__u32) pid_tgid;
Expand Down
2 changes: 2 additions & 0 deletions plugins/in_ebpf/traces/vfs/bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
#include <gadget/types.h>

#include "common/events.h"
#include "common/event_id.bpf.h"

#define MAX_ENTRIES 10240

Expand Down Expand Up @@ -87,6 +88,7 @@ int trace_vfs_openat_exit(struct syscall_trace_exit *ctx)

uid_gid = bpf_get_current_uid_gid();

generate_event_id(&event->common.event_id);
event->common.timestamp_raw = bpf_ktime_get_boot_ns();
event->common.pid = pid_tgid >> 32;
event->common.tid = tid;
Expand Down
Loading