user: custom mapSize flag. improve memory usage #433 .

cli/cmd/bash.go

@@ -76,6 +76,7 @@ func bashCommandFunc(command *cobra.Command, args []string) {
 	bc.Uid = gConf.Uid
 	bc.Debug = gConf.Debug
 	bc.IsHex = gConf.IsHex
+	bc.SetPerCpuMapSize(gConf.mapSizeKB)
 
 	logger.Printf("ECAPTURE :: pid info :%d", os.Getpid())
 	//bc.Pid = globalFlags.Pid

cli/cmd/global.go

@@ -35,8 +35,8 @@ type GlobalFlags struct {
 	Debug      bool
 	Pid        uint64 // PID
 	Uid        uint64 // UID
-	NoSearch   bool   // No lib search
 	LoggerAddr string // save file
+	mapSizeKB  int    // ebpf map size per CPU
 	addrType   uint8  // 0:stdout, 1:file, 2:tcp
 	address    string
 	writer     io.Writer
@@ -63,7 +63,7 @@ func getGlobalConf(command *cobra.Command) (conf GlobalFlags, err error) {
 		return
 	}
 
-	conf.NoSearch, err = command.Flags().GetBool("nosearch")
+	conf.mapSizeKB, err = command.Flags().GetInt("map-size")
 	if err != nil {
 		return
 	}

cli/cmd/gnutls.go

@@ -97,6 +97,7 @@ func gnuTlsCommandFunc(command *cobra.Command, args []string) {
 		conf.SetUid(gConf.Uid)
 		conf.SetDebug(gConf.Debug)
 		conf.SetHex(gConf.IsHex)
+		conf.SetPerCpuMapSize(gConf.mapSizeKB)
 
 		err = conf.Check()
 

cli/cmd/gotls.go

@@ -88,7 +88,7 @@ func goTLSCommandFunc(command *cobra.Command, args []string) {
 	conf.SetUid(gConf.Uid)
 	conf.SetDebug(gConf.Debug)
 	conf.SetHex(gConf.IsHex)
-	//conf.SetNoSearch(gConf.NoSearch)
+	conf.SetPerCpuMapSize(gConf.mapSizeKB)
 
 	err = conf.Check()
 

cli/cmd/mysqld.go

@@ -70,6 +70,7 @@ func mysqldCommandFunc(command *cobra.Command, args []string) {
 	mysqldConfig.Pid = gConf.Pid
 	mysqldConfig.Debug = gConf.Debug
 	mysqldConfig.IsHex = gConf.IsHex
+	mysqldConfig.SetPerCpuMapSize(gConf.mapSizeKB)
 
 	log.Printf("ECAPTURE :: pid info :%d", os.Getpid())
 	//bc.Pid = globalFlags.Pid

cli/cmd/nss.go

@@ -97,6 +97,7 @@ func nssCommandFunc(command *cobra.Command, args []string) {
 		conf.SetUid(gConf.Uid)
 		conf.SetDebug(gConf.Debug)
 		conf.SetHex(gConf.IsHex)
+		conf.SetPerCpuMapSize(gConf.mapSizeKB)
 
 		err = conf.Check()
 

cli/cmd/postgres.go

@@ -66,7 +66,7 @@ func postgresCommandFunc(command *cobra.Command, args []string) {
 	postgresConfig.Pid = gConf.Pid
 	postgresConfig.Debug = gConf.Debug
 	postgresConfig.IsHex = gConf.IsHex
-
+	postgresConfig.SetPerCpuMapSize(gConf.mapSizeKB)
 	log.Printf("ECAPTURE :: pid info: %d", os.Getpid())
 	//bc.Pid = globalFlags.Pid
 	if e := postgresConfig.Check(); e != nil {

cli/cmd/root.go

@@ -90,9 +90,9 @@ func init() {
 	// Cobra also supports local flags, which will only run
 	// when this action is called directly.
 	//rootCmd.Flags().BoolP("toggle", "t", false, "Help message for toggle")
-	rootCmd.PersistentFlags().BoolVarP(&globalFlags.Debug, "debug", "d", false, "enable debug logging")
+	rootCmd.PersistentFlags().BoolVarP(&globalFlags.Debug, "debug", "d", false, "enable debug logging.(coming soon)")
 	rootCmd.PersistentFlags().BoolVar(&globalFlags.IsHex, "hex", false, "print byte strings as hex encoded strings")
-	rootCmd.PersistentFlags().BoolVar(&globalFlags.NoSearch, "nosearch", false, "no lib search")
+	rootCmd.PersistentFlags().IntVar(&globalFlags.mapSizeKB, "map-size", 1024*5, "eBPF map size per CPU,for events buffer. default:5120. (KB)")
 	rootCmd.PersistentFlags().Uint64VarP(&globalFlags.Pid, "pid", "p", defaultPid, "if pid is 0 then we target all pids")
 	rootCmd.PersistentFlags().Uint64VarP(&globalFlags.Uid, "uid", "u", defaultUid, "if uid is 0 then we target all users")
 	rootCmd.PersistentFlags().StringVarP(&globalFlags.LoggerAddr, "log-addr", "l", "", "-l /tmp/ecapture.log or -l tcp://127.0.0.1:8080")

cli/cmd/tls.go

@@ -105,7 +105,7 @@ func openSSLCommandFunc(command *cobra.Command, args []string) {
 		conf.SetUid(gConf.Uid)
 		conf.SetDebug(gConf.Debug)
 		conf.SetHex(gConf.IsHex)
-
+		conf.SetPerCpuMapSize(gConf.mapSizeKB)
 		err = conf.Check()
 
 		if err != nil {

user/config/common_androidgki.go

@@ -17,13 +17,18 @@
 
 package config
 
+import (
+	"os"
+)
+
 // https://source.android.com/devices/architecture/vndk/linker-namespace
 var (
 	default_so_paths = []string{
 		"/data/asan/system/lib64",
 		"/apex/com.android.conscrypt/lib64",
 		"/apex/com.android.runtime/lib64/bionic",
 	}
+	DefaultMapSizePerCpu = os.Getpagesize() * 512
 )
 
 const ElfArchIsandroid = true

user/config/common_linux.go

@@ -17,7 +17,10 @@
 
 package config
 
-import "log"
+import (
+	"log"
+	"os"
+)
 
 const (
 	LdLoadPath       = "/etc/ld.so.conf"
@@ -40,6 +43,9 @@ var (
 		"/usr/lib64",
 		"/lib64",
 	}
+
+	// default: 4MB
+	DefaultMapSizePerCpu = os.Getpagesize() * 1024
 )
 
 func GetDynLibDirs() []string {

user/config/config_bash.go

@@ -31,6 +31,7 @@ type BashConfig struct {
 
 func NewBashConfig() *BashConfig {
 	config := &BashConfig{}
+	config.PerCpuMapSize = DefaultMapSizePerCpu
 	return config
 }
 

user/config/config_gnutls.go

@@ -24,5 +24,6 @@ type GnutlsConfig struct {
 
 func NewGnutlsConfig() *GnutlsConfig {
 	config := &GnutlsConfig{}
+	config.PerCpuMapSize = DefaultMapSizePerCpu
 	return config
 }

user/config/config_gotls.go

@@ -49,7 +49,9 @@ type GoTLSConfig struct {
 
 // NewGoTLSConfig creates a new config for Go SSL
 func NewGoTLSConfig() *GoTLSConfig {
-	return &GoTLSConfig{}
+	gc := &GoTLSConfig{}
+	gc.PerCpuMapSize = DefaultMapSizePerCpu
+	return gc
 }
 
 func (gc *GoTLSConfig) Check() error {

user/config/config_mysqld.go

@@ -49,6 +49,7 @@ type MysqldConfig struct {
 
 func NewMysqldConfig() *MysqldConfig {
 	config := &MysqldConfig{}
+	config.PerCpuMapSize = DefaultMapSizePerCpu
 	return config
 }
 

user/config/config_nspr.go

@@ -24,5 +24,6 @@ type NsprConfig struct {
 
 func NewNsprConfig() *NsprConfig {
 	config := &NsprConfig{}
+	config.PerCpuMapSize = DefaultMapSizePerCpu
 	return config
 }

user/config/config_nspr_linux.go

@@ -36,11 +36,6 @@ func (nc *NsprConfig) Check() error {
 		return nil
 	}
 	/*
-		if nc.NoSearch {
-			return errors.New("NoSearch requires specifying lib path")
-		}
-
-
 		//如果配置 Curlpath的地址，判断文件是否存在，不存在则直接返回
 		if nc.Firefoxpath != "" || len(strings.TrimSpace(nc.Firefoxpath)) > 0 {
 			_, e := os.Stat(nc.Firefoxpath)

user/config/config_openssl.go

@@ -49,6 +49,7 @@ type OpensslConfig struct {
 
 func NewOpensslConfig() *OpensslConfig {
 	config := &OpensslConfig{}
+	config.PerCpuMapSize = DefaultMapSizePerCpu
 	return config
 }
 

user/config/config_postgres.go

@@ -32,6 +32,7 @@ type PostgresConfig struct {
 
 func NewPostgresConfig() *PostgresConfig {
 	config := &PostgresConfig{}
+	config.PerCpuMapSize = DefaultMapSizePerCpu
 	return config
 }
 

user/config/iconfig.go

@@ -14,7 +14,9 @@
 
 package config
 
-import "ecapture/pkg/util/kernel"
+import (
+	"ecapture/pkg/util/kernel"
+)
 
 type IConfig interface {
 	Check() error //检测配置合法性
@@ -26,14 +28,17 @@ type IConfig interface {
 	SetUid(uint64)
 	SetHex(bool)
 	SetDebug(bool)
+	GetPerCpuMapSize() int
+	SetPerCpuMapSize(int)
 	EnableGlobalVar() bool //
 }
 
 type eConfig struct {
-	Pid   uint64
-	Uid   uint64
-	IsHex bool
-	Debug bool
+	Pid           uint64
+	Uid           uint64
+	PerCpuMapSize int // ebpf map size for per Cpu.   see https://github.com/gojue/ecapture/issues/433 .
+	IsHex         bool
+	Debug         bool
 }
 
 func (c *eConfig) GetPid() uint64 {
@@ -68,6 +73,14 @@ func (c *eConfig) SetHex(isHex bool) {
 	c.IsHex = isHex
 }
 
+func (c *eConfig) GetPerCpuMapSize() int {
+	return c.PerCpuMapSize
+}
+
+func (c *eConfig) SetPerCpuMapSize(size int) {
+	c.PerCpuMapSize = size
+}
+
 func (c *eConfig) EnableGlobalVar() bool {
 	kv, err := kernel.HostVersion()
 	if err != nil {

user/module/imodule.go

@@ -26,7 +26,6 @@ import (
 	"github.com/cilium/ebpf/perf"
 	"github.com/cilium/ebpf/ringbuf"
 	"log"
-	"os"
 	"strings"
 )
 
@@ -190,7 +189,7 @@ func (m *Module) readEvents() error {
 }
 
 func (m *Module) perfEventReader(errChan chan error, em *ebpf.Map) {
-	rd, err := perf.NewReader(em, os.Getpagesize()*BufferSizeOfEbpfMap)
+	rd, err := perf.NewReader(em, m.conf.GetPerCpuMapSize())
 	if err != nil {
 		errChan <- fmt.Errorf("creating %s reader dns: %s", em.String(), err)
 		return