add new counter for sk_buff failures

elastic · Sep 17, 2024 · 7ea1643 · 7ea1643
1 parent 520c8d4
commit 7ea1643
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 1 deletion.
diff --git a/GPL/Events/EbpfEventProto.h b/GPL/Events/EbpfEventProto.h
@@ -406,6 +406,7 @@ struct ebpf_dns_event {
 struct ebpf_event_stats {
     uint64_t lost; // lost events due to a full ringbuffer
     uint64_t sent; // events sent through the ringbuffer
+    uint64_t paged_out; // indicates that that a given sk_buff event contained no non-paged data
 };
 
 #endif // EBPF_EVENTPROBE_EBPFEVENTPROTO_H
diff --git a/GPL/Events/Network/Probe.bpf.c b/GPL/Events/Network/Probe.bpf.c
@@ -134,7 +134,7 @@ static int udp_skb_handle(struct sk_buff *skb, enum ebpf_net_udp_info evt_type)
         u32 zero                    = 0;
         struct ebpf_event_stats *es = bpf_map_lookup_elem(&ringbuf_stats, &zero);
         if (es != NULL) {
-            es->lost++;
+            es->paged_out++;
         }
         goto out;
     }

diff --git a/non-GPL/Events/Lib/EbpfEvents.c b/non-GPL/Events/Lib/EbpfEvents.c
@@ -820,6 +820,7 @@ int ebpf_event_ctx__read_stats(struct ebpf_event_ctx *ctx, struct ebpf_event_sta
     for (i = 0; i < libbpf_num_possible_cpus(); i++) {
         ees->lost += pcpu_ees[i].lost;
         ees->sent += pcpu_ees[i].sent;
+        ees->paged_out += pcpu_ees[i].paged_out;
     }
 
     return 0;