Disable metrics also in eBPF if disabled

pkg/ebpftracer/c/headers/common/buffer.h

@@ -25,8 +25,9 @@ statfunc int save_str_arr_to_buf(args_buffer_t *, const char __user *const __use
 statfunc int save_args_str_arr_to_buf(args_buffer_t *, const char *, const char *, int, u8);
 statfunc int save_sockaddr_to_buf(args_buffer_t *, struct socket *, u8);
 statfunc int save_args_to_submit_buf(event_data_t *, args_t *);
-statfunc int events_perf_submit(program_data_t *, u32 id, long);
-statfunc int signal_perf_submit(void *, controlplane_signal_t *sig, u32 id);
+
+#define events_perf_submit(p, id, ret)        do_perf_submit(&events, p, id, ret)
+#define signal_events_perf_submit(p, id, ret) do_perf_submit(&signal_events, p, id, ret)
 
 // FUNCTIONS
 
@@ -581,20 +582,4 @@ statfunc int net_events_perf_submit(void *ctx, u32 id, event_data_t *event)
     return bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, event, size);
 }
 
-statfunc int signal_perf_submit(void *ctx, controlplane_signal_t *sig, u32 id)
-{
-    sig->event_id = id;
-
-    u32 size =
-        sizeof(u32) + sizeof(u8) + sig->args_buf.offset; // signal id + argnum + arg buffer size
-
-    // inline bounds check to force compiler to use the register of size
-    asm volatile("if %[size] < %[max_size] goto +1;\n"
-                 "%[size] = %[max_size];\n"
-                 :
-                 : [size] "r"(size), [max_size] "i"(MAX_SIGNAL_SIZE));
-
-    return bpf_perf_event_output(ctx, &signals, BPF_F_CURRENT_CPU, sig, size);
-}
-
 #endif

pkg/ebpftracer/c/headers/common/consts.h

@@ -61,6 +61,7 @@ typedef struct {
     u64 flow_sample_submit_interval_seconds;
     u64 flow_grouping;
     bool track_syscall_stats;
+    bool export_metrics;
 } global_config_t;
 
 volatile const global_config_t global_config;

pkg/ebpftracer/c/headers/common/metrics.h

@@ -2,10 +2,15 @@
 #define __COMMON_METRICS_H__
 
 #include "common/common.h"
+#include "common/consts.h"
 #include "types.h"
 
 statfunc void metrics_increase(enum metric m)
 {
+    if (!global_config.export_metrics) {
+        return;
+    }
+
     if (m >= MAX_METRIC) {
         enum metric unknown = UNKNOWN_METRIC;
         u64 *counter = bpf_map_lookup_elem(&metrics, &unknown);
@@ -19,7 +24,8 @@ statfunc void metrics_increase(enum metric m)
     if (unlikely(counter == NULL)) {
         return;
     }
-    // When the u64 overflows, we should start back at 0, so there is no need to think about reseting the counter.
+    // When the u64 overflows, we should start back at 0, so there is no need to think about
+    // reseting the counter.
     __sync_fetch_and_add(counter, 1);
 }
 

pkg/ebpftracer/c/headers/maps.h

@@ -106,7 +106,6 @@ BPF_LRU_HASH(bpf_attach_map, u32, bpf_used_helpers_t, 1024);
 BPF_LRU_HASH(bpf_attach_tmp_map, u32, bpf_used_helpers_t, 1024);                        // temporarily hold bpf_used_helpers_t
 BPF_LRU_HASH(bpf_prog_load_map, u32, void *, 1024);                                     // store bpf prog aux pointer between bpf_check and security_bpf_prog
 BPF_PERCPU_ARRAY(event_data_map, event_data_t, 1);                                      // persist event related data
-BPF_PERCPU_ARRAY(signal_data_map, controlplane_signal_t, 1);                            // signal scratch map
 BPF_PERCPU_ARRAY(netflows_data_map, event_data_t, SCRATCH_MAP_SIZE);                    // netflows scratch map
 BPF_HASH(logs_count, bpf_log_t, bpf_log_count_t, 4096);                                 // logs count
 BPF_PERCPU_ARRAY(scratch_map, scratch_t, 2);                                            // scratch space to avoid allocating stuff on the stack

pkg/ebpftracer/c/headers/types.h

@@ -128,9 +128,10 @@ enum event_id_e {
     MODULE_LOAD,
     MODULE_FREE,
     SOCK_SET_STATE,
-    MAX_EVENT_ID,
     PROCESS_OOM_KILLED,
     TTY_OPEN,
+
+    MAX_EVENT_ID,
 };
 
 enum signal_event_id_e {
@@ -363,20 +364,7 @@ typedef struct event_data {
     u64 in_use;
 } event_data_t;
 
-// A control plane signal - sent to indicate some critical event which should be processed
-// with priority.
-//
-// Signals currently consist of shortened events sent only with their arguments.
-// As such, they consist of an event id and an argument buffer.
-// If we ever require a signal independent of an event, the event_id field should change
-// accordingly.
-typedef struct controlplane_signal {
-    u32 event_id;
-    args_buffer_t args_buf;
-} controlplane_signal_t;
-
-#define MAX_EVENT_SIZE  sizeof(event_context_t) + sizeof(u8) + ARGS_BUF_SIZE
-#define MAX_SIGNAL_SIZE sizeof(u32) + sizeof(u8) + ARGS_BUF_SIZE
+#define MAX_EVENT_SIZE sizeof(event_context_t) + sizeof(u8) + ARGS_BUF_SIZE
 
 #define BPF_MAX_LOG_FILE_LEN 72
 

pkg/ebpftracer/c/tracee.bpf.c

@@ -37,7 +37,6 @@
 #include <common/memory.h>
 #include <common/network.h>
 #include <common/probes.h>
-#include <common/signal.h>
 #include <common/debug.h>
 #include <common/stats.h>
 #include <common/metrics.h>

pkg/ebpftracer/events/events.go

@@ -98,9 +98,10 @@ const (
 	ModuleLoad
 	ModuleFree
 	SockSetState
-	MaxCommonID
 	ProcessOomKilled
 	TtyOpen
+
+	MaxCommonID
 )
 
 // Events originated from user-space

pkg/ebpftracer/module.go

@@ -71,6 +71,7 @@ func (m *module) load(cfg Config) error {
 			FlowSampleSubmitIntervalSeconds: cfg.NetflowSampleSubmitIntervalSeconds,
 			FlowGrouping:                    uint64(cfg.NetflowGrouping),
 			TrackSyscallStats:               cfg.TrackSyscallStats,
+			ExportMetrics:                   cfg.MetricsReportingEnabled,
 		},
 	}); err != nil {
 		return err