bpf-metrics-exporter

Exports metrics from the kernel's BPF subsystem to OpenTelmetry. These can later be enriched with other metrics from the system, for example, to correlate process IDs -> containers -> k8s pods.

Usage

./bpf-metrics-exporter --otlp-grpc localhost:4317

Metrics

The following metrics are currently exported, this list will continue to expand:

Gauges

• bpf_program_info: Information on each loaded BPF Program
  • Labels:
    • id: The ID of the BPF program
    • name: The name of the BPF program
    • type: The type of the BPF program as a readable string
    • tag: The tag of the BPF program
    • gpl_compatible: Whether the BPF program is GPL compatible
    • load_time: The time the BPF program was loaded
• bpf_map_info: Information of each loaded BPF Map
  • Labels:
    • id: The ID of the BPF map
    • name: The name of the BPF map
    • type: The type of the BPF map as an u32 which corresponds to the following kernel enumeration
    • key_size: The key size in bytes for the BPF map
    • value_size: The value size for the BPF map
    • max_entries: The maximum number of entries for the BPF map.
    • flags: Loadtime specific flags for the BPF map
• bpf_link_info: Information on each of the loaded BPF Link
  • Labels:
    • id: The ID of the bpf Link
    • prog_id: The Program ID of the BPF program which is using the Link.
    • type: The BPF Link type as a u32 which corresponds to the following kernel enumeration
• bpf_program_load_time: The standard UTC time the program was loaded in seconds
  • Labels:
    • id: The ID of the BPF program
    • name: The name of the BPF program
    • type: The type of the BPF program as a readable string

Counters

Note: All counters will have the suffix _total appended.

• bpf_program_size_jitted_bytes: The size in bytes of the program's JIT-compiled machine code.
  • Labels:
    • id: The ID of the BPF program
    • name: The name of the BPF program
    • type: The type of the BPF program as a readable string
• bpf_program_size_translated_bytes: The size of the BPF program in bytes.
  • Labels:
    • id: The ID of the BPF program
    • name: The name of the BPF program
    • type: The type of the BPF program as a readable string
• bpf_program_mem_bytes: The amount of memory used by the BPF program in bytes.
  • Labels:
    • id: The ID of the BPF program
    • name: The name of the BPF program
    • type: The type of the BPF program as a readable string
• bpf_program_verified_instructions: The number of instructions in the BPF program.
  • Labels:
    • id: The ID of the BPF program
    • name: The name of the BPF program
    • type: The type of the BPF program as a readable string
• bpf_map_key_size: The size of the BPF map key
  • Labels:
    • id: The ID of the BPF map
    • name: The name of the BPF map
    • type: The type of the BPF map as an u32 which corresponds to the following kernel enumeration
• bpf_map_value_size: The size of the BPF map value
  • Labels:
    • id: The ID of the BPF map
    • name: The name of the BPF map
    • type: The type of the BPF map as an u32 which corresponds to the following kernel enumeration
• bpf_map_max_entries: The maximum number of entries allowed for the BPF map
  • Labels:
    • id: The ID of the BPF map
    • name: The name of the BPF map
    • type: The type of the BPF map as an u32 which corresponds to the following kernel enumeration

Try it out

You'll need a Grafana stack set up. You can quickly deploy one using:

podman play kube metrics-stack.yaml

Then, you can deploy the exporter:

sudo ./target/debug/bpf-metrics-exporter

You can log into grafana at http://localhost:3000/ using the default user:password admin:admin.

From there simply select the default dashboard titled eBPF Subsystem Metrics:

In order to clean everything up simply exit the bpf-metrics-exporter process with ctrl+c and run:

podman kube down metrics-stack.yaml