The probe process walker was consuming a lot of CPU because it needed to regularly read many files scattered in /proc/<pid>/stat, count file descriptors in /proc/<pid>/fd/, read the command name in /proc/<pid>/comm etc..
From Linux 5.9, it will be possible to use BPF iterators to get some information about all processes and all file descriptors in one read syscall instead of reading many files scattered in /proc. The Linux commit acf61631746c ("tools/bpf: selftests: Add iter progs for bpf_map/task/task_file") gives an example how to write a BPF iterator to get all processes and file descriptors in one read.
Weave Scope could make use of this new kernel feature to use less CPU.
I am not sure if BPF iterators would allow the probe to get all the information we need (not sure how to get the amount of memory used by a process from a BPF iterator), but it seems doable for most of the other information.
The probe process walker was consuming a lot of CPU because it needed to regularly read many files scattered in
/proc/<pid>/stat, count file descriptors in/proc/<pid>/fd/, read the command name in/proc/<pid>/commetc..From Linux 5.9, it will be possible to use BPF iterators to get some information about all processes and all file descriptors in one read syscall instead of reading many files scattered in /proc. The Linux commit acf61631746c ("tools/bpf: selftests: Add iter progs for bpf_map/task/task_file") gives an example how to write a BPF iterator to get all processes and file descriptors in one read.
Weave Scope could make use of this new kernel feature to use less CPU.
I am not sure if BPF iterators would allow the probe to get all the information we need (not sure how to get the amount of memory used by a process from a BPF iterator), but it seems doable for most of the other information.