Conversation
A 64 bit TraceHash was used to differentiate between hashes on a host vs hashes on a global context. The later one are 128 bit hashes. Signed-off-by: Florian Lehner <florian.lehner@elastic.co>
bpfTraceCache used to be essential for the eBPF to user space communication at the time when only hashes and their respective count were reported. As this workflow got refactores, this is no longer required. Signed-off-by: Florian Lehner <florian.lehner@elastic.co>
|
|
||
| if !m.reporter.SupportsReportTraceEvent() { | ||
| // Fast path: if the trace is already known remotely, we just send a counter update. | ||
| postConvHash, traceKnown := m.bpfTraceCache.Get(bpfTrace.Hash) |
There was a problem hiding this comment.
Doesn't this change our 128bit hashes we report to the backend completely?
Essentially, the hashing logic in ConvertTrace is no longer used, in favor of
tmpHash := xxh3.Hash128(raw)
trace.Hash = libpf.NewTraceHash(tmpHash.Hi, tmpHash.Lo)
which has different characteristics and cardinality as it's our 64bit hash extended. This is probably not what we want for the 128bit hash.
There was a problem hiding this comment.
No, it does not affect the hash that is reported to the backend. If it would change the reported hash, this proposed change would be a breaking change.
The hash, that is used to report back to the backend is untouched and happens in ConvertTrace() after the symbolization:
There was a problem hiding this comment.
But we're calling in line 139:
m.reporter.ReportCountForTrace(bpfTrace.Hash, 1, meta)
bpfTrace.Hash is the extended 64bit hash, not the post-conversion hash.
There was a problem hiding this comment.
good catch 👍
The hash returned by ConvertTrace() is stored for translation in bpfTraceCache and therefore this should not change. I will close the PR.
2 participants
This is a follow up to #340.
When working on #340 I realized we still differentiate between hashes on a host (64 bit) and global hashes (128 bit). With the rework on how traces and their counts are reported to user space, this differentiation is no longer needed.
Therefore we can use just one kind of hash, reduce the memory footprint of a map that converts these hashes and avoid additional computing for hashes.