tracee icon indicating copy to clipboard operation
tracee copied to clipboard

[FEAT] Wait for perf buffer to empty before exiting tracee-ebpf

Open AsafEitani opened this issue 3 years ago • 0 comments

Prerequisites

  • [x] This issue is an EPIC issue (add label: EPIC).
  • [ ] This issue is an EPIC TASK (add issue to EPIC description).

Select one OR another:

  • [ ] I'll create a PR to implement this feature (assign to yourself).
  • [x] Someone else should implement this (describe it well).

Feature description

After sending a termination signal to tracee-ebpf (Ctrl+C), tracee-ebpf should first kill the bpf programs, and continue to consume events from the perf buffer in the go userspace. This will empty the perf buffer and no event will be lost due to premature exit.

Additional Information (feature drawings, files, logs, etc)

AsafEitani avatar Sep 19 '22 12:09 AsafEitani