1
0
Fork 0
mirror of https://github.com/imjasonh/snoop synced 2026-07-14 19:35:42 +00:00
snoop/pkg
Jason Hall 87dab9839a Add ring buffer overflow detection and metrics
Implement comprehensive ring buffer overflow handling:

- Add dropped_events BPF map to track overflow in kernel space
- Create submit_event() helper that checks bpf_ringbuf_output() return
  value and atomically increments drop counter on failure
- Add Drops() method to read drop counter from eBPF map
- Add snoop_events_dropped_total Prometheus metric
- Track drop deltas and log warnings when overflow occurs
- Include drop count in JSON reports

Ring buffer overflows can occur under high load when events are
generated faster than userspace can consume them. This implementation
provides full observability into overflow events without data loss
of the drop count itself.

Signed-off-by: Jason Hall <jason@chainguard.dev>
2026-01-14 10:33:55 -05:00
..
cgroup initial commit 2026-01-14 09:55:28 -05:00
ebpf Add ring buffer overflow detection and metrics 2026-01-14 10:33:55 -05:00
metrics Add ring buffer overflow detection and metrics 2026-01-14 10:33:55 -05:00
processor Add structured logging with clog 2026-01-14 10:27:27 -05:00
reporter Add structured logging with clog 2026-01-14 10:27:27 -05:00