Simple eBPF program to retrieve DTRACE_PROBE calls

47 views Asked by At

I have a binary that is instrumented with DTRACE_PROBE2 in its source code. It has two arguments, one numeric ID, and a string payload.

I verified that the USDT tracepoint is actually hit by running the following bpftrace line:

BPFTRACE_STRLEN=200 sudo -E bpftrace -e 'usdt:/my/path/to/bin:span_emit { printf("%s\n", str(arg1)); }'

And, length constraints aside, it works like a charm. The tracepoints are emitting OpenTelemetry spans by the way.

Now I'd like to actually receive the strings using a receiver program, but I am stuck on how that could work. I'd really like to listen for the tracepoints to be hit and collect the string arguments and post-process them somehow.

I know that the BCC crate for Rust and package for Python both should be able to attach to the tracepoint and receive the payload, but with the various parts of the eBPF ecosystem, I'm having trouble formulating the correct BPF program, and matching harness for it.

0

There are 0 answers