-
Describe the bug Using the uretprobe example as my starting point, I tried to get file paths from a tracepoint using To Reproduce Send a payload larger than
Expected behavior
|
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 12 replies
-
A perf ring has no "inherent sample size", you can submit samples of variable length to it if you want. Therefore the perf reader can't know whether 4096 is enough for your needs or not. I think if you check the return code from |
Beta Was this translation helpful? Give feedback.
A perf ring has no "inherent sample size", you can submit samples of variable length to it if you want. Therefore the perf reader can't know whether 4096 is enough for your needs or not.
I think if you check the return code from
bpf_perf_event_output
you'll see that it returns an error because the sample was too big. You may also be able to check https://pkg.go.dev/github.com/cilium/ebpf/perf#Record LostSamples but I haven't validated that.