1

I have written an eBPF program which captures HTTP requests and responses using kprobes on system calls like accept4, accept, read, write, close(both entry & exit) and sending these as a captured event to userspace using ringbuf. I have few questions which i am unable to find out.

  1. How many concurrent requests this setup can handle?
  2. Since i was missing some kretprobes on read system call due to low default value of maxactive parameter (determines number of kretprobes instances), so i have set this to some value say 1024(max = 4096). I know that even at this maximum value some kretprobes will be ignored. But still how much it can handle say i am on 2 core cpu.
  3. So i will set this maxactive parameter to all of the above mentioned syscall kretprobe, what can be the overhead?

I have limited familiarity with eBPF and its concepts, please help.

Architecture: x86_64

Kernel Version: 5.15+

Gourav Kumar
  • 205
  • 1
  • 7

0 Answers0