探针内多处使用bpf_buffer__open可能导致fd资源耗尽

**问题描述** 
当gopher探针包含多个子探针，且每个子探针都会调用bpf_buffer__open初始化ebpf event buffer时，若目标机器的cpu数量比较多且内核版本只支持perf buffer（5.8内核以上才支持ring buffer）时，探针启动时会出现fd资源耗尽导致探针启动失败的问题。

下图是tprofiling探针启动时fd资源占用情况，可以看到随着启动的子探针数量增加，perf-event类型的fd数量每次都会增加192个，当超过上限（一般都是配置的1024）时，fd资源就会耗尽。
```bash
(base) [root@localhost ]# uname -r
4.19.90-2107.6.0.0098.oe1.bclinux.aarch64
(base) [root@localhost ]# lscpu | grep CPU:
CPU:                             192
(base) [root@localhost ]# curl -X PUT http://localhost:9999/tprofiling -d json='{"cmd":{"probe": ["python_gc"]}, "snoopers":{"proc_name": [{"comm":"python3", "cmdline":"pygc"}, {"comm":"python3", "cmdline":"write-big-file"}]},"params":{"report_period":10}, "state": "running"}'    { "result": "success", "message":"New config takes effect" }
(base) [root@localhost ]# sh ./test-tp-fdnum.sh `pidof tprofiling`
pid=1538597, total fd nums: 233, pipe fd nums: 1, anon_inode fd nums: 227
          anon_inode detail: bpf-prog=2, bpf-map=26, perf-event=192, eventpoll=3
(base) [root@localhost ]#
(base) [root@localhost ]# curl -X PUT http://localhost:9999/tprofiling -d json='{"cmd":{"probe": ["python_gc", "oncpu"]}, "snoopers":{"proc_name": [{"comm":"python3", "cmdline":"pygc"}, {"comm":"python3", "cmdline":"write-big-file"}]},"params":{"report_period":10}, "state": "running"}'
{ "result": "success", "message":"New config takes effect" }
(base) [root@localhost ]# sh ./test-tp-fdnum.sh `pidof tprofiling`
pid=1538597, total fd nums: 441, pipe fd nums: 1, anon_inode fd nums: 435
          anon_inode detail: bpf-prog=3, bpf-map=39, perf-event=385, eventpoll=4
(base) [root@localhost ]#
(base) [root@localhost ]# curl -X PUT http://localhost:9999/tprofiling -d json='{"cmd":{"probe": ["python_gc", "oncpu", "syscall_file"]}, "snoopers":{"proc_name": [{"comm":"python3", "cmdline":"pygc"}, {"comm":"python3", "cmdline":"write-big-file"}]},"params":{"report_period":10}, "state": "running"}'
{ "result": "success", "message":"New config takes effect" }
(base) [root@localhost ]# sh ./test-tp-fdnum.sh `pidof tprofiling`
pid=1538597, total fd nums: 692, pipe fd nums: 1, anon_inode fd nums: 686
          anon_inode detail: bpf-prog=23, bpf-map=57, perf-event=597, eventpoll=5
(base) [root@localhost ]#
(base) [root@localhost ]# curl -X PUT http://localhost:9999/tprofiling -d json='{"cmd":{"probe": ["python_gc", "oncpu", "syscall_file", "syscall_net"]}, "snoopers":{"proc_name": [{"comm":"python3", "cmdline":"pygc"}, {"comm":"python3", "cmdline":"write-big-file"}]},"params":{"report_period":10}, "state": "running"}'
{ "result": "success", "message":"New config takes effect" }
(base) [root@localhost ]# sh ./test-tp-fdnum.sh `pidof tprofiling`
pid=1538597, total fd nums: 927, pipe fd nums: 1, anon_inode fd nums: 921
          anon_inode detail: bpf-prog=35, bpf-map=75, perf-event=801, eventpoll=6
```

**问题根因**
每个子探针调用bpf_buffer__open初始化ebpf event buffer时，如果当前内核版本不支持ring buffer，则会创建perf buffer类型的buffer，每创建一个perf buffer结构，都会打开`cpu数量`个perf-event类型的fd。当cpu数量比较多时，fd会增长很快。

**问题排查**
经查询，当前gopher还有多个探针存在该问题，可考虑优化。
![输入图片说明](https://foruda.gitee.com/images/1714274733724749148/5d491968_5601155.png "屏幕截图")

**优化建议**
多个子探针共享同一个ebpf event buffer结构。

openEuler/gala-gopher

内容风险标识

评论 (2)

openEuler/gala-gopher .gitee-modal { width: 500px !important; }

内容风险标识