Add support for linux perf_events subsystem

[juju4]

System info:

Linux

Feature Request

Capsule8 has published 2 blog posts to detect meltdown/spectre poc through

• linux segmentation faults https://capsule8.com/blog/detecting-meltdown-using-capsule8/
• linux perf cache side channel activity https://capsule8.com/blog/detecting-meltdown-spectre-detecting-cache-side-channels/

should be similar for perfmon on Windows unsure on macos

Telegraf has inputs from https://github.com/influxdata/telegraf/tree/release-1.5/plugins/inputs/win_perf_counters https://github.com/influxdata/telegraf/tree/release-1.5/plugins/inputs/sysstat but no linux perf as far as I can tell

Proposal:

Any plan to support linux perf?

In the meantime, sysstat can be use for page faults monitoring but I don't think it's an option for cache side channels activity. Sadly, I'm not sure if options for macos to do the same.

Use case: [Why is this important (helps with prioritizing requests)]

Better troubleshooting of hardware activity and security monitoring as hardware exploitation will most probably continue to develop.

Thanks

[danielnelson]

Due to the never ending stream of security bugs I don't know if we will add any plugins that directly target specific issues, but we could add new metrics that allow monitoring to be done.

There are no concrete plans at this time for adding support for perf_events, but it would be a nice feature to have.

[juju4]

Thanks @danielnelson

ok for perf_events not available. any comments on page fault availability/usability?

[danielnelson]

In the kernel_vmstat plugin there is a pgfault and pgmajfault field, these are taken from /proc/vmstat, does that look like the data you are after?

[juju4]

it seems so. Thanks a lot @danielnelson!

[powersj]

Closing as user got the various metrics they were looking for.