Make shark without eBPF support

[aktau]

Hi, Following @brendangregg's shoutout I decided to check out shark and what I saw looked very good indeed (I happen to love Lua(JIT), both from the inside and the outside).

However, not all of use have the luxury of running on 4.0+ kernels. Technically, I could still use the perf module and already do useful stuff with that. Is there support for that and if not, would that be desired?

Thanks!

[sharklinux]

Hi,

shark's bpf module and perf module is completely separated, you still can use perf module even don't have Linux 4.0+ kernel.

One thing worth to note is shark will become more powerful after:

1. ebpf become more powerful, integrate with perf and output stream data through perf ring buffer. That means we can programming bpf output data in lua script, much easer then C.
2. support packet capture The next big milestone of shark is support packet capture, you can capture http/tcp/udp/snmp packets, and view in cloud instantly.

Thanks.

[aktau]

The problem is that I can't seem to compile shark without having eBPF headers. I get compile errors. I just tried running make, in fact. What sort of things do I need?

[sharklinux]

Sorry, I missed that point.

Please pull again, fixed now, just using: make BPF_DISABLE=1

(todo: I will make this variable to be automatic set, depend on host kernel version)

[aktau]

It works, fantastic, thanks!