OOM kill tracking (#252)

includes/bpf_helpers.h

@@ -21,6 +21,8 @@ static int (*bpf_map_delete_elem)(void *map, void *key) =
 	(void *) BPF_FUNC_map_delete_elem;
 static int (*bpf_probe_read)(void *dst, int size, void *unsafe_ptr) =
 	(void *) BPF_FUNC_probe_read;
+static int (*bpf_probe_read_str)(void *dst, int size, void *unsafe_ptr) =
+	(void *)BPF_FUNC_probe_read_str;
 static unsigned long long (*bpf_ktime_get_ns)(void) =
 	(void *) BPF_FUNC_ktime_get_ns;
 static int (*bpf_trace_printk)(const char *fmt, int fmt_size, ...) =

includes/netdata_ebpf.h

@@ -19,6 +19,7 @@ This header has the common definitions for all `.c` files.
 #include "netdata_fs.h"
 #include "netdata_hardirq.h"
 #include "netdata_mount.h"
+#include "netdata_oomkill.h"
 #include "netdata_process.h"
 #include "netdata_socket.h"
 #include "netdata_softirq.h"
@@ -115,7 +116,7 @@ static inline void libnetdata_update_u32(u32 *res, u32 value)
         return;
 
     __sync_fetch_and_add(res, value);
-    if ( (0xFFFFFFFFFFFFFFFF - *res) <= value) {
+    if ( (0xFFFFFFFF - *res) <= value) {
         *res = value;
     }
 }

includes/netdata_oomkill.h

@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+#ifndef _NETDATA_OOMKILL_H_
+#define _NETDATA_OOMKILL_H_ 1
+
+// to try and only use 4096 bytes in the map and no more given 4 byte keys & 1
+// byte values, we choose a very small number.
+#define NETDATA_OOMKILL_MAX_ENTRIES 64
+
+// /sys/kernel/debug/tracing/events/oom/mark_victim/
+struct netdata_oom_mark_victim_entry {
+    u64 pad;                    // This is not used with eBPF
+    int pid;                    // offset:8;       size:4; signed:1;
+};
+
+#endif /* _NETDATA_OOMKILL_H_ */

kernel/Makefile

@@ -44,6 +44,7 @@ NETDATA_APPS= btrfs \
 	      mount \
 	      msync \
 	      nfs \
+	      oomkill \
 	      process \
 	      socket \
 	      softirq \

kernel/README.md

@@ -26,6 +26,7 @@ Right now we have the following `eBPF` program collectors:
 - `mount_kern.c`          : monitor calls for syscalls `mount` and `umount`.
 - `msync_kern.c`          : monitor calls for syscall `msync`.
 - `nfs_kern.c`            : provides nfs monitoring.
+- `oomkill_kern.c`        : provides info on which processes got OOM killed.
 - `process_kern.c`        : provides process, file and VFS stats.
 - `socket_kern.c`         : provides network stats;
 - `softirq_kern.c`        : provides software interrupt (soft IRQ) latency monitoring.

kernel/oomkill_kern.c

@@ -0,0 +1,29 @@
+#define KBUILD_MODNAME "oomkill_netdata"
+#include <linux/bpf.h>
+#include <linux/ptrace.h>
+#include <linux/oom.h>
+#include <linux/threads.h>
+
+#include "bpf_helpers.h"
+#include "netdata_ebpf.h"
+
+struct bpf_map_def SEC("maps") tbl_oomkill = {
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,15,0))
+    .type = BPF_MAP_TYPE_HASH,
+#else
+    .type = BPF_MAP_TYPE_PERCPU_HASH,
+#endif
+    .key_size = sizeof(int),
+    .value_size = sizeof(__u8),
+    .max_entries = NETDATA_OOMKILL_MAX_ENTRIES
+};
+
+SEC("tracepoint/oom/mark_victim")
+int netdata_oom_mark_victim(struct netdata_oom_mark_victim_entry *ptr) {
+    int key = ptr->pid;
+    u8 val = 0;
+    bpf_map_update_elem(&tbl_oomkill, &key, &val, BPF_ANY);
+    return 0;
+}
+
+char _license[] SEC("license") = "GPL";