Jakub Nyckowski 7fab8fadc6 Currently, our BPF modules send all events from the kernel to the userspace, where we filter them and log only the ones related to our process. Sending the events between the user and kernel space is expensive, and most of the events are discarded after. (#19354) ...

This PR moves the filtering from the userspace to the kernel, where we can filter them earlier and not pay for sending all events to our userspace process. Because the filtering happens in the kernel, the BPF test had to be rewritten to execute events in a sub-cgroup instead of the global one.

2023-02-07 19:20:55 +00:00

..

cgroup_test.go

Enable GCI linter (#17894)

2022-10-28 20:20:28 +00:00

cgroup.go

Currently, our BPF modules send all events from the kernel to the userspace, where we filter them and log only the ones related to our process. Sending the events between the user and kernel space is expensive, and most of the events are discarded after. (#19354)

2023-02-07 19:20:55 +00:00