Fixes

cmd/agent/daemon/daemon.go

@@ -75,9 +75,9 @@ func NewRunCommand(version string) *cobra.Command {
 		ebpfTracerMetricsEnabled       = command.Flags().Bool("ebpf-tracer-metrics-enabled", true, "Enables the export of tracer related metrics from eBPF")
 		ebpfProgramMetricsEnabled      = command.Flags().Bool("ebpf-program-metrics-enabled", false, "Enables the export of metrics about eBPF programs")
 
-		EBPFSignalEventsRingBufferSize = command.Flags().Uint32("ebpf-signal-events-ring-buffer-size", 1<<20, "Ebpf ring buffer size in bytes for priority events")
-		EBPFEventsRingBufferSize       = command.Flags().Uint32("ebpf-events-ring-buffer-size", 1<<20, "Ebpf ring buffer size in bytes for events")
-		EBPFSkbEventsRingBufferSize    = command.Flags().Uint32("ebpf-skb-events-ring-buffer-size", 1<<20, "Ebpf ring buffer size in bytes for skb network events")
+		EBPFSignalEventsRingBufferSize = command.Flags().Uint32("ebpf-signal-events-ring-buffer-size", 1<<20, "Ebpf ring buffer size in bytes for priority events. Should be power of 2")
+		EBPFEventsRingBufferSize       = command.Flags().Uint32("ebpf-events-ring-buffer-size", 1<<20, "Ebpf ring buffer size in bytes for events. Should be power of 2")
+		EBPFSkbEventsRingBufferSize    = command.Flags().Uint32("ebpf-skb-events-ring-buffer-size", 1<<20, "Ebpf ring buffer size in bytes for skb network events. Should be power of 2")
 
 		mutedNamespaces = command.Flags().StringSlice("ignored-namespaces", []string{"kube-system", "calico", "calico-system"},
 			"List of namespaces to ignore tracing events for. To ignore multiple namespaces, separate by comma or pass flag multiple times."+

pkg/ebpftracer/c/tracee.bpf.c

@@ -1742,6 +1742,7 @@ statfunc u32 cgroup_skb_submit(void *map, struct __sk_buff *ctx, net_event_conte
     }
 
     e->argnum = 1;
+    e->index0 = 0;
     e->bytes = size;
     e->eventctx.eventid = event_type;
 

pkg/ebpftracer/metrics.go

@@ -86,9 +86,7 @@ func (t *Tracer) exportEBPFTracerMetrics() error {
 	for iter.Next(&metric, &counter) {
 		name := eBPFMetric(metric).String()
 		metrics.EBPFExposedMetrics.WithLabelValues(name).Set(float64(counter))
-		if counter > 0 {
-			t.logInternalEbpfTracerMetric(name, counter)
-		}
+		t.logInternalEbpfTracerMetric(name, counter)
 	}
 	if err := iter.Err(); err != nil {
 		return err

pkg/ebpftracer/tracer.go

@@ -229,7 +229,13 @@ func (t *Tracer) runPerfBufReaderLoop(ctx context.Context, target *ebpf.Map) err
 	if err != nil {
 		return err
 	}
-	defer eventsReader.Close()
+
+	go func() {
+		<-ctx.Done()
+		if err := eventsReader.Close(); err != nil {
+			t.log.Warnf("closing events reader: %v", err)
+		}
+	}()
 
 	// Allocate message decoder and perf record once.
 	// Under the hood per event reader will reuse and grow raw sample backing bytes slice.

pkg/ebpftracer/tracer_playground_test.go

@@ -67,7 +67,7 @@ func TestTracer(t *testing.T) {
 	tr := ebpftracer.New(log, ebpftracer.Config{
 		//BTFPath:              fmt.Sprintf("./testdata/5.10.0-0.deb10.24-cloud-%s.btf", runtime.GOARCH),
 		EventsOutputChanSize:       10000,
-		SignalEventsRingBufferSize: 1 << 20,
+		SignalEventsRingBufferSize: 1 << 12,
 		EventsRingBufferSize:       1 << 12,
 		SkbEventsRingBufferSize:    1 << 12,
 
@@ -102,6 +102,10 @@ func TestTracer(t *testing.T) {
 		NetflowSampleSubmitIntervalSeconds: 2,
 		NetflowGrouping:                    ebpftracer.NetflowGroupingDropSrcPort,
 		ProcessTreeCollector:               processtree.NewNoop(),
+		MetricsReporting: ebpftracer.MetricsReportingConfig{
+			ProgramMetricsEnabled: true,
+			TracerMetricsEnabled:  true,
+		},
 	})
 	defer tr.Close()
 
@@ -120,9 +124,8 @@ func TestTracer(t *testing.T) {
 
 	policy := &ebpftracer.Policy{
 		Events: []*ebpftracer.EventPolicy{
-			{ID: events.NetPacketSSHBase},
 			//{ID: events.SockSetState},
-			//{ID: events.NetPacketDNSBase},
+			{ID: events.NetPacketDNSBase},
 			//{ID: events.NetPacketTCPBase},
 			//{ID: events.SchedProcessExec},
 		},

tools/codegen/generator.go

@@ -105,16 +105,14 @@ var (
 )
 
 // eventMaxByteSliceBufferSize is used to determine the max slice size allowed for different
-// event types. For example, most events have a max size of 4096, but for network related events
-// there is no max size (this is represented as -1).
+// event types. For example, most events have a max size of 4096, but for network we limit to 512 bytes.
 func eventMaxByteSliceBufferSize(id events.ID) int {
   // For non network event, we have a max byte slice size of 4096
   if id < events.NetPacketBase || id > events.MaxNetID {
     return 4096
   }
 
-  // Network events do not have a max buffer size.
-  return -1
+  return 512
 }
 `, targetPackage)
 }