Module export_event

The event exporter SPDX-License-Identifier: MIT

Copyright (c) 2023, eunomia-bpf All rights reserved.

Event exporter for bpf-loader-rs

What does this module do?

In a nut shell, this module provides a struct EventExporter, which accepts exported data from a ebpf program, verifies the data, then output them to stdout or the user-provided callback function.

Constructors

Usually, ebpf program will export data sampled from the kernel in one of the two ways:

• ringbuf
• bpf map There are also two constructors for EventExporter, which corresponds to the two ways, EventExporterBuilder::build_for_ringbuf and EventExporterBuilder::build_for_map_sampling

What will be produced

You can get the data you want in one of the three formats:

• Json
• PlainText
• RawEvent

Each time the EventExporter received data from the ebpf program, it will convert the data to the format you want, and call the callback function to acknowledge you the data, or print that to stdout

Json

Convert the received data to a JsonValue. With the help of BTF, we can know at which offset exists which type of data. So It’s ok to construct a JsonValue representing the type we want to see. The JsonValue will be passed to the callback in string format, or printed to stdout if you don’t want to provide a callback

PlainText

It’s similar to JSON, except that it’s not structured, only human readable texts

RawEvent

It will call the callback with the original data received from ebpf program. If no callback was provided, it will do nothing.

Modules

type_descriptor

Contains utilities to describe where to obtain the export type of a map SPDX-License-Identifier: MIT

Structs

EventExporter

dump export event in user space

EventExporterBuilder

The builder of the EventExporter

Enums

ExportFormatType

Describe the export format type

ReceivedEventData

Represents a sample data that the user will receive

Traits

EventHandler

A handler to receive events provided by ebpf kernel program