Shulou(Shulou.com)06/02 Report--

This article introduces the knowledge of "how to use ebpf to monitor the time-consuming cycle of Node.js events". Many people will encounter this dilemma in the operation of actual cases, so let the editor lead you to learn how to deal with these situations. I hope you can read it carefully and be able to achieve something!

Foreword:

Powerful ebpf is more and more widely used and can do more and more things, especially the non-invasive and elegant way is a good choice for technology selection. This article describes how to use ebpf to monitor the time consumed by Node.js to understand the execution of the Node.js event loop. However, this is only coarse-grained monitoring, and there are still many things that need to be done if you want to understand the operation of Node.js in detail.

In Node.js, we can understand the time-consuming execution of JS through the cpuprofile of V8 Inspector, but cpuprofile can not see that the execution of C and C++ code is time-consuming. Usually, we can use perf tools to achieve C, C++ code. However, what is introduced here is achieved through ebpf, which is a kind of exploration.

First, let's take a look at the monitoring of the poll io phase. First define a structure to record the time spent.

Struct event

{

_ _ u64 start_time

_ _ u64 end_time

}

Continue to write the bpf program.

# include

# include

# include

# include

# include "uv.h"

# include "uv_uprobe.h"

Char LICENSE [] SEC ("license") = "Dual BSD/GPL"

# define MAX_ENTRIES 10240

/ / used to record data

Struct {

_ _ uint (type, BPF_MAP_TYPE_HASH)

_ _ uint (max_entries, MAX_ENTRIES)

_ _ type (key, _ _ U32)

_ _ type (value, const char *)

} values SEC (".maps")

/ / used to input data to the user layer

Struct {

_ _ uint (type, BPF_MAP_TYPE_PERF_EVENT_ARRAY)

_ _ uint (key_size, sizeof (_ _ U32))

_ _ uint (value_size, sizeof (_ _ U32))

} events SEC (".maps")

Static _ _ U64 id = 0

SEC ("uprobe/uv__io_poll")

Int BPF_KPROBE (uprobe_uv__io_poll, uv_loop_t* loop, int timeout)

{

_ _ U64 current_id = id

_ _ U64 time = bpf_ktime_get_ns ()

Bpf_map_update_elem & values, & current_id, & time, BPF_ANY)

Return 0

}

SEC ("uretprobe/uv__io_poll")

Int BPF_KRETPROBE (uretprobe_uv__io_poll)

{

_ _ U64 current_id = id

_ _ U64 * time = bpf_map_lookup_elem (& values, & current_id)

If (! Time) {

Return 0

}

Struct event e

/ / record the start time and end time

E.start_time = * time

E.end_time = bpf_ktime_get_ns ()

/ / output to the user layer

Bpf_perf_event_output (ctx, & events, BPF_F_CURRENT_CPU, & e, sizeof (e))

Bpf_map_delete_elem (& values, & current_id)

Id++

Return 0

}

Finally, write the code that uses the ebpf program, listing only the core code.

# include

# include

# include

# include

# include

# include "uv_uprobe.skel.h"

# include "uprobe_helper.h"

# include

# include

# include "uv_uprobe.h"

/ / output result function

Static void handle_event (void * ctx, int cpu, void * data, _ _ U32 data_sz)

{

Const struct event * e = (const struct event *) data

Printf ("% s% llu\ n", "poll io", (e-> end_time-e-> start_time) / 1000 / 1000)

}

Int main (int argc, char * * argv)

{

Struct uv_uprobe_bpf * skel

Long base_addr, uprobe_offset

Int err, i

Struct perf_buffer_opts pb_opts

Struct perf_buffer * pb = NULL

/ / which Node.js process is monitored

Char * pid_str = argv [1]

Pid_t pid = (pid_t) atoi (pid_str)

Char execpath [500]

/ / find the executable file of Node.js according to pid

Int ret = get_pid_binary_path (pid, execpath, 500)

/ / function to be monitored. Uv__io_poll is a function that handles the poll io phase.

Char * func = "uv__io_poll"

/ / obtain the address of the function through the executable file

Uprobe_offset = get_elf_func_offset (execpath, func)

/ / load the bpf program into the kernel

Skel = uv_uprobe_bpf__open ()

Err = uv_uprobe_bpf__load (skel)

/ / Mount the monitoring point

Skel- > links.uprobe_uv__io_poll = bpf_program__attach_uprobe (skel- > progs.uprobe_uv__io_poll)

False / * not uretprobe * /

-1

Execpath

Uprobe_offset)

Skel- > links.uretprobe_uv__io_poll = bpf_program__attach_uprobe (skel- > progs.uretprobe_uv__io_poll)

True / * uretprobe * /

-1 / * any pid * /

Execpath

Uprobe_offset)

/ / set the output of callback processing bpf

Pb_opts.sample_cb = handle_event

Pb_opts.lost_cb = handle_lost_events

Pb = perf_buffer__new (bpf_map__fd (skel- > maps.events), PERF_BUFFER_PAGES

& pb_opts)

Printf ("%-7s%-7s\ n", "phase", "interval")

For (I = 0;; iTunes +) {

/ / wait for the output of bpf, and then execute callback processing, based on epoll implementation

Perf_buffer__poll (pb, PERF_POLL_TIMEOUT_MS)

}

}

Compile the above code, then start a Node.js process, and then take the pid of the Node.js process as a parameter to execute the above code, you can see the poll io phase of the time-consuming, usually, if there are no tasks in the Node.js will block into the epoll_wait, so we can not observe the time-consuming. All we have to do is write a timer in the code.

SetInterval (() = > {}, 3000)

one

We can see that the poll io takes about 3 seconds, because when there is a timer, the poll io will return after waiting for 3 seconds at most, which is the time spent in the entire poll io phase. Now that we understand the basic implementation, let's monitor the time spent at each stage of the entire event loop. The principle is similar. First define a macro that handles multiple phases.

# define PHASE (uprobe)\

Uprobe (uv__run_timers)\

Uprobe (uv__run_pending)\

Uprobe (uv__run_idle)\

Uprobe (uv__run_prepare)\

Uprobe (uv__io_poll)\

Uprobe (uv__run_check)\

Uprobe (uv__run_closing_handles)

Then change the bpf code.

# define PROBE (type)\

SEC ("uprobe/" # type)\

Int BPF_KPROBE (uprobe_##type)\

{\\

Char key [20] = # type;\

_ U64 time = bpf_ktime_get_ns ();\

Bpf_map_update_elem (& values, & key, & time, BPF_ANY);

Return 0;\

}\

SEC ("uretprobe/" # type)\

Int BPF_KRETPROBE (uretprobe_##type)\

{\\

Char key [20] = # type;\

_ U64 * time = bpf_map_lookup_elem (& values, & key);\

If (! Time) {\

Return 0;\

}\

Struct event e = {\

.name = # type\

};\

E.start_time = * time;\

E.end_time = bpf_ktime_get_ns ();\

Bpf_perf_event_output (ctx, & events, BPF_F_CURRENT_CPU, & e, sizeof (e));\

Bpf_map_delete_elem (& values, key);\

Return 0;\

}

PHASE (PROBE)

We see that the code is the same as the previous bpf code, but through the way of macros, it is easy to define multiple phases and avoid duplicating code. Mainly some knowledge of using C. # an equals "a", axioub equals ab, and "a"b" equals "ab" (with a space between "a" and "b"). Similarly, after writing the bpf code, change the code of the main program.

# define ATTACH_UPROBE (type)\

Do\

{char * func_##type = # type;\

Uprobe_offset = get_elf_func_offset (execpath, func_##type);\

If (uprobe_offset =-1) {\

Fprintf (stderr, "invalid function & s:% s\ n", func_##type);\

Break;\

}\

Fprintf (stderr, "uprobe_offset:% ld\ n", uprobe_offset);\

Skel- > links.uprobe_##type = bpf_program__attach_uprobe (skel- > progs.uprobe_##type,\

False / * not uretprobe * /,\

Pid,\

Execpath,\

Uprobe_offset);\

Skel- > links.uretprobe_##type = bpf_program__attach_uprobe (skel- > progs.uretprobe_##type,\

True / * uretprobe * /,\

Pid / * any pid * /,\

Execpath,\

Uprobe_offset);\

} while (false)

PHASE (ATTACH_UPROBE)

Again, the code is the same, except that it becomes a macro definition, and then repeats the code through the PHASE (ATTACH_UPROBE) definition. Do while (false) is used here because if there is a problem with the process at some stage, it is ignored, because we cannot return directly, so do while is a better way to implement it. Because when I tested, there were two phases that failed because the address of the corresponding function could not be found. Finally, write a test code.

Function compute () {

Let sum = 0

For (let I = 0; I

< 10000000; i++） { sum += i; } } setInterval（（） =>

{

Compute ()

SetImmediate () = > {

Compute ()

})

}, 10000)

That's all for "how to use ebpf to monitor the time-consuming of Node.js event loops". Thank you for reading. If you want to know more about the industry, you can follow the website, the editor will output more high-quality practical articles for you!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.