pulsar
pulsar copied to clipboard
Make sending large eBPF events more memory efficient
When sending events from eBPF programs to userspace, we always allocate the max length of bytes the given field supports. For example, in file-system-monitor, we send filenames of NAME_MAX
length (1024) even when it's much shorter. Moreover, this leads us to being excessively conservative with the maximum field lengths.
We should design a data structure/protocol which allows to send only the data actually needed.
Once this if fixed, we increase the following constants:
- [ ] file-system-monitor. The maximum file paths should be 4096
- [ ] process-monitor. The maximum path of binaries should be 4096
- [ ] process-monitor. Ideally, the maximum arguments size should be 2097152