ebpf_exporter

1
#include <vmlinux.h>
2
#include <bpf/bpf_tracing.h>
3
#include <bpf/bpf_core_read.h>
4

5
struct {
6
    __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
7
    __uint(key_size, sizeof(u32));
8
    __uint(value_size, sizeof(u32));
9
} oom_kills_total SEC(".maps");
10

11
SEC("kprobe/oom_kill_process")
12
int BPF_KPROBE(kprobe__oom_kill_process, struct oom_control *oc, const char *message)
13
{
14
    u64 cgroup_id = 0;
15

16
    struct mem_cgroup *mcg = BPF_CORE_READ(oc, memcg);
17
    if (mcg) {
18
        cgroup_id = BPF_CORE_READ(mcg, css.cgroup, kn, id);
19
    }
20

21
    bpf_perf_event_output(ctx, &oom_kills_total, BPF_F_CURRENT_CPU, &cgroup_id, sizeof(cgroup_id));
22

23
    return 0;
24
}
25

26
char LICENSE[] SEC("license") = "GPL";
27