search

elastic / ebpf

Elastic's eBPF
Other
67 stars 11 forks source link

Investigate whether it's possible to make PathResolver more resilient to long paths #70

Open mmat11 opened 2 years ago

mmat11 commented 2 years ago

Podman / overlayfs:

{"event_type":"FILE_RENAME","pids": ...,"old_path":"./test","new_path":"./test2"}
mv-170700  [003] d...  9717.441932: bpf_trace_printk: path truncated
mv-170700  [003] d...  9717.441938: bpf_trace_printk: path truncated

Check if the bottleneck is PATH_RESOLVER_MAX_COMPONENTS or PATH_MAX and if it makes sense to allocate more space; evaluate how often this happen

fntlnz commented 2 years ago

This also happens with overlayfs2, while with fuse-overlayfs it seems good.