pulsar icon indicating copy to clipboard operation
pulsar copied to clipboard

Make sending large eBPF events more memory efficient

Open MatteoNardi opened this issue 2 years ago • 1 comments

When sending events from eBPF programs to userspace, we always allocate the max length of bytes the given field supports. For example, in file-system-monitor, we send filenames of NAME_MAX length (1024) even when it's much shorter. Moreover, this leads us to being excessively conservative with the maximum field lengths.

We should design a data structure/protocol which allows to send only the data actually needed.

MatteoNardi avatar Oct 10 '22 07:10 MatteoNardi

Once this if fixed, we increase the following constants:

  • [ ] file-system-monitor. The maximum file paths should be 4096
  • [ ] process-monitor. The maximum path of binaries should be 4096
  • [ ] process-monitor. Ideally, the maximum arguments size should be 2097152

MatteoNardi avatar Oct 10 '22 07:10 MatteoNardi