Add logger to display BPF logs (#955)

bpf/bpf_dbg.h

@@ -9,12 +9,38 @@
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
-
 #ifndef BPF_DBG_H
 #define BPF_DBG_H
 
 #ifdef BPF_DEBUG
-#define bpf_dbg_printk(fmt, args...) bpf_printk(fmt, ##args)
+
+typedef struct log_info {
+    char log[80];
+    char comm[20];
+    u64 pid;
+} log_info_t;
+
+struct {
+    __uint(type, BPF_MAP_TYPE_RINGBUF);
+    __uint(max_entries, 1 << 12);
+    __uint(pinning, LIBBPF_PIN_BY_NAME);    
+} debug_events SEC(".maps");
+
+#define bpf_dbg_helper(fmt, args...) { \
+    {log_info_t *__trace__ = bpf_ringbuf_reserve(&debug_events, sizeof(log_info_t), 0); \
+    if (__trace__) { \
+        BPF_SNPRINTF(__trace__->log, sizeof(__trace__->log), fmt, ##args); \
+        u64 id = bpf_get_current_pid_tgid(); \
+        bpf_get_current_comm(&__trace__->comm, sizeof(__trace__->comm)); \
+        __trace__->pid = id >> 32; \
+        bpf_ringbuf_submit(__trace__, 0); \
+    }} \
+}
+
+#define bpf_dbg_printk(fmt, args...) { \
+    bpf_printk(fmt, ##args); \
+    bpf_dbg_helper(fmt, ##args); \
+}
 #else
 #define bpf_dbg_printk(fmt, args...)
 #endif

bpf/debug_log.c

@@ -0,0 +1,5 @@
+#include "vmlinux.h"
+#include "bpf_helpers.h"
+#include "bpf_dbg.h"
+
+const log_info_t *unused_100 __attribute__((unused));

pkg/internal/discover/watcher_proc.go

@@ -16,6 +16,7 @@ import (
 
 	"github.com/grafana/beyla/pkg/beyla"
 	"github.com/grafana/beyla/pkg/internal/ebpf"
+	"github.com/grafana/beyla/pkg/internal/ebpf/logger"
 	"github.com/grafana/beyla/pkg/internal/ebpf/watcher"
 	"github.com/grafana/beyla/pkg/services"
 )
@@ -61,6 +62,7 @@ func ProcessWatcherFunc(ctx context.Context, cfg *beyla.Config) pipe.StartFunc[[
 		listProcesses:     fetchProcessPorts,
 		executableReady:   executableReady,
 		loadBPFWatcher:    loadBPFWatcher,
+		loadBPFLogger:     loadBPFLogger,
 		fetchPorts:        true,  // must be true until we've activated the bpf watcher component
 		bpfWatcherEnabled: false, // async set by listening on the bpfWatchEvents channel
 		stateMux:          sync.Mutex{},
@@ -95,6 +97,7 @@ type pollAccounter struct {
 	executableReady func(PID) bool
 	// injectable function to load the bpf program
 	loadBPFWatcher func(cfg *beyla.Config, events chan<- watcher.Event) error
+	loadBPFLogger  func(cfg *beyla.Config) error
 	// we use these to ensure we poll for the open ports effectively
 	stateMux          sync.Mutex
 	bpfWatcherEnabled bool
@@ -110,6 +113,12 @@ func (pa *pollAccounter) Run(out chan<- []Event[processAttrs]) {
 		log.Error("Unable to load eBPF watcher for process events", "error", err)
 	}
 
+	if pa.cfg.EBPF.BpfDebug {
+		if err := pa.loadBPFLogger(pa.cfg); err != nil {
+			log.Error("Unable to load eBPF logger for process events", "error", err)
+		}
+	}
+
 	go pa.watchForProcessEvents(log, bpfWatchEvents)
 
 	for {
@@ -320,3 +329,8 @@ func loadBPFWatcher(cfg *beyla.Config, events chan<- watcher.Event) error {
 	wt := watcher.New(cfg, events)
 	return ebpf.RunUtilityTracer(wt, BuildPinPath(cfg))
 }
+
+func loadBPFLogger(cfg *beyla.Config) error {
+	wt := logger.New(cfg)
+	return ebpf.RunUtilityTracer(wt, BuildPinPath(cfg))
+}

pkg/internal/discover/watcher_proc_test.go

@@ -33,6 +33,7 @@ func TestWatcher_Poll(t *testing.T) {
 	acc := pollAccounter{
 		interval: time.Microsecond,
 		ctx:      ctx,
+		cfg:      &beyla.Config{},
 		pidPorts: map[pidPort]processAttrs{},
 		listProcesses: func(bool) (map[PID]processAttrs, error) {
 			invocation++
@@ -55,6 +56,9 @@ func TestWatcher_Poll(t *testing.T) {
 		loadBPFWatcher: func(*beyla.Config, chan<- watcher.Event) error {
 			return nil
 		},
+		loadBPFLogger: func(*beyla.Config) error {
+			return nil
+		},
 	}
 	accounterOutput := make(chan []Event[processAttrs], 1)
 	accounterExited := make(chan struct{})
@@ -125,6 +129,7 @@ func TestProcessNotReady(t *testing.T) {
 	acc := pollAccounter{
 		interval: time.Microsecond,
 		ctx:      context.Background(),
+		cfg:      &beyla.Config{},
 		pidPorts: map[pidPort]processAttrs{},
 		listProcesses: func(bool) (map[PID]processAttrs, error) {
 			return map[PID]processAttrs{p1.pid: p1, p5.pid: p5, p2.pid: p2, p3.pid: p3, p4.pid: p4}, nil
@@ -135,6 +140,9 @@ func TestProcessNotReady(t *testing.T) {
 		loadBPFWatcher: func(*beyla.Config, chan<- watcher.Event) error {
 			return nil
 		},
+		loadBPFLogger: func(*beyla.Config) error {
+			return nil
+		},
 	}
 
 	procs, err := acc.listProcesses(true)
@@ -185,6 +193,9 @@ func TestPortsFetchRequired(t *testing.T) {
 			channelReturner <- events
 			return nil
 		},
+		loadBPFLogger: func(*beyla.Config) error {
+			return nil
+		},
 		stateMux:          sync.Mutex{},
 		bpfWatcherEnabled: false,
 		fetchPorts:        true,