feat: support sql server - #11214
Open
yuanchaoa wants to merge 1023 commits into
Open
Conversation
…ms (#11064) Most 64-bit Linux kernels use a default page size of **4KB**. However, on some high-end ARM 64-bit (AArch64) platforms, the system may be configured with a larger page size, such as **16KB** or **64KB**. In such environments, using the configuration option `inputs.ebpf.tunning.perf_pages_count` directly based on the system page size can lead to **excessive memory consumption** for the perf buffer. This is because: 1. The perf buffer is allocated **per CPU**; 2. A larger system page size (e.g., 64KB) significantly increases the memory used per page; 3. On systems with a large number of CPUs, this memory usage is further amplified. As a result, the total memory consumption of the perf buffer can be calculated as: ``` Total perf buffer memory = page count × page size × number of CPUs ``` To mitigate excessive memory usage on systems with large page sizes and many CPUs, we define `inputs.ebpf.tunning.perf_pages_count` as the number of **4KB pages**, rather than system pages. In other words, this configuration option effectively specifies a **fixed total memory size (in 4KB units)**. At runtime, the program dynamically adjusts and recalculates the actual number of system pages based on the current system page size (4KB / 16KB / 64KB, etc.). This approach ensures consistent perf buffer memory usage across different systems and avoids unnecessary memory amplification on large-page and high-CPU-count platforms.
* feat: eBPF TLS decryption supports OpenSSL 3.2+ * fix: eBPF TLS decryption supports OpenSSL 3.2.4+
* fix: otel does not use fastpath * fix: L7 only doesn't parse retransmitted packets
**复现步骤** 启用 eBPF TCP Option 注入后，现有 v1 格式只携带 PID 和源 IPv4，无法为 Process GPID 查询提供 Agent ID。 **原因和解决方案** 增加 TCP Option 注入版本配置，保留 magic 0xDEE9 的 v1 格式并新增携带 PID 与 Agent ID 的 v2 格式；默认使用 v2。eBPF 侧原子更新采样窗口、版本和 Agent ID，解析侧在同时存在时优先选择 v2。 **影响范围** Agent 的 TCP Option 注入、解析和 Process GPID 关联逻辑，以及 agent 配置模板和生成文档。 **验证方案** - cargo fmt --all -- --check - just check - make user/tcp_option_tracing_bpf_common.c - make staticobjs/user/tcp_option_tracing.o - 按要求未运行 Go 测试 **涉及分支** * main **检查项** - [ ] 需要更新依赖 - [ ] 是共性问题(代码中存在类似问题) - [x] 编译通过 - [x] 单元测试通过 /assign @xiangyang /cc @yuanchao @jinjie @zhuofeng
* fix(java): add comprehensive JVM attach preflight Add a shared java_attach_preflight() gate used by both the Java symbol collector and deepflow-jattach before socket creation, Agent SO copying, or injection. The preflight validates process liveness and zombie state, identifies HotSpot/OpenJ9 from the target maps, executes the target JVM's -version in the correct Host/POD namespace, and rechecks PID start time and executable path to detect reuse. For HotSpot Java 8, distinguish the 8u0-351 range missing JDK-8173361 from the 8u352-381 range missing the 8u-specific JDK-8305165 follow-up; keep 8u382 as the complete-fix attach baseline and log the two skip reasons separately. Also reject DisableAttachMechanism and unreadable attach options, harden command/output buffers, and add the local release-check script plus investigation and operator documentation. * fix(java): match attach option boundaries * fix(java): execute version check in target rootfs * fix(ebpf): close namespace fd on setup failure * fix(java): use target namespaces for safe version preflight Replace the JVM version probe based on host nsenter, chroot, release files, and timeout helpers with the java_mnt_ns_version flow. Read the target executable and NUL-separated environment from procfs, construct the target Java library path, enter the target PID and mount namespaces with setns, and run the target executable's Java 8-compatible -version command through popen. Restore both namespace selections after pclose and verify that the current process and subsequently created children remain in the original namespaces. Keep failures conservative so attach is skipped when target metadata, namespace switching, version execution, parsing, or restoration cannot be verified. Add the standalone namespace-version test tool to the eBPF tools build and document the workflow, limitations, and validation cases. * fix(java): bound namespace version probing with helper Run JVM version preflight in an isolated helper and runner process instead of calling popen from the Agent thread. The helper enters the target PID and mount namespaces, then forks a runner that directly execve()s the target Java executable with the target runtime environment and -version arguments. Keep the Agent parent in its original namespaces and use a dedicated process group so a five-second monotonic-clock deadline can terminate both helper and runner without leaving descendants behind. Read version output through a nonblocking pipe, preserve Java 8-compatible version probing, and fail closed when namespace setup, execution, timeout, output, or version parsing cannot be verified. Apply the same helper/runner implementation to java_mnt_ns_version, add parent and child namespace verification, and update the preflight documentation to describe the new lifecycle and timeout behavior. * docs(java): describe helper version wait timeout Document the parent-process wait loop used by JVM version preflight. Explain the pipe read/write ends, nonblocking output drain, WNOHANG polling of the helper, 100 millisecond poll intervals, monotonic five-second deadline, and process-group cleanup on timeout. Clarify that the timeout applies to the helper and runner version probe rather than the target Java business process, and that failures fail closed by skipping attach. * fix(java): bound namespace version probing with helper Run JVM version preflight in an isolated helper and runner process instead of calling popen from the Agent thread. The helper enters the target PID and mount namespaces, then forks a runner that directly execve()s the target Java executable with the target runtime environment and -version arguments. Keep the Agent parent in its original namespaces and use a dedicated process group so a five-second monotonic-clock deadline can terminate both helper and runner without leaving descendants behind. Read version output through a nonblocking pipe, preserve Java 8-compatible version probing, and fail closed when namespace setup, execution, timeout, output, or version parsing cannot be verified. Apply the same helper/runner implementation to java_mnt_ns_version, add parent and child namespace verification, and update the preflight documentation to describe the new lifecycle and timeout behavior. * docs(java): describe helper version wait timeout Document the parent-process wait loop used by JVM version preflight. Explain the pipe read/write ends, nonblocking output drain, WNOHANG polling of the helper, 100 millisecond poll intervals, monotonic five-second deadline, and process-group cleanup on timeout. Clarify that the timeout applies to the helper and runner version probe rather than the target Java business process, and that failures fail closed by skipping attach. * fix(ebpf): avoid truncating exec command buffer * fix(java): distinguish missing JVM patch reasons
fix(java): bound symbol send retries and bump agent version\n\nAdd a consecutive EAGAIN threshold for non-blocking Java Agent sockets and close the communication channels after 30 retries to avoid an endless busy loop in JVM callbacks.\n\nBump JAVA_AGENT_VERSION from 3.1 to 3.2 for the updated GNU and musl Agent artifacts.
The Java version helper guards namespace entry with __NR_setns, but jvm_symbol_collect.c did not include sys/syscall.h. This left the syscall number undefined and made the helper exit with status 124 before entering the target namespaces. Include the syscall header so the helper executes the intended setns path.
yuanchaoa
force-pushed
the
support-sql-server
branch
from
August 20, 2026 08:29
cd24437 to
130d1ad
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
12 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR is for:
feat: support sql server
Checklist
Backport to branches