alibaba / kubeskoop

Network monitoring & diagnosis suite for Kubernetes
https://kubeskoop.io
Apache License 2.0
587 stars 68 forks source link

[discuss] about genrating evt of packetloss #299

Open dzy176 opened 5 months ago

dzy176 commented 5 months ago

Hi, I see in packetloss, if sth is wrong in GetSymsByStack() , the evt won't be sent to the sink because we continue to skip the next steps :

    stacks, err := bpfutil.GetSymsByStack(uint32(event.StackId), p.objs.InspPlStack)
    if err != nil {
        log.Warnf("%s failed get sym by stack, err: %v", probeName, err)
        continue
    }

It means we finaly miss record this event. Actually in my production env, I do encounter this problem, I get some packetloss metric but no event. So how about not continue,


    stacks, err := bpfutil.GetSymsByStack(uint32(event.StackId), p.objs.InspPlStack)
    if err != nil {
        log.Warnf("%s failed get sym by stack, err: %v", probeName, err)
        // continue
                evt.Message = "unknown"
    } else {
      var strs []string
      for _, sym := range stacks {
          if _, ok := ignoreSymbolList[sym.GetName()]; ok {
              goto anotherLoop
          }
          strs = append(strs, sym.GetExpr())
      }
      evt.Message = strings.Join(strs, "\n") 
        }
jzwlqx commented 4 months ago

Stop on failing getting kernel symbol to avoid too many meaningless drop event (drop event on tcp closing e.g.).

I understand user do need the event regardless of whether symbol was resolved. Should we add a config for packetloss probe to specify the behaviour when cannot resolve symbol