Processes name stop displaying after some time about pwru HOT 6 OPEN

This is because pwru fetches pid in kernel space while converts pid to process name in user space, so if the process sending skb is terminated before pwru starts the pid->pname convertion, no process can be found to match pid.

Indeed we can fetch pname in bpf kernel space via task->comm or task->mm->arg_start, but that approach might impact performance.

Another easy fix is to cache pname in pwru user space during an skb's lifetime.

from pwru.

Indeed we can fetch pname in bpf kernel space via task->comm or task->mm->arg_start, but that approach might impact performance.

Probably not worth the trade-off. If this happens only when the process is terminated early, then I'd say it's fine to miss info like the process name, rather than slow down the whole execution.

Another easy fix is to cache pname in pwru user space during an skb's lifetime.

Sounds like a better option to me, for what it's worth.

from pwru.

I was thinking using a user-space map[skb]pname to cache pname conversion, but that actually doesn't make sense because an skb could be transferred between processes (e.g. from a client process to a server process).

Then I thought we could cache map[pid]pname, but the entry eviction is tricky, we should find an appropriate event to delete an pid->pname entry in map, instead of caching the entry forever. LRU? Timer? Tracing the lifetime of a process?

from pwru.

Another easy fix is to cache pname in pwru user space during an skb's lifetime.

Any TL;DR how it would work?

from pwru.

Not sure about others, but TBH for me a process name is very little of use when debugging.

from pwru.

Then I thought we could cache map[pid]pname, but the entry eviction is tricky, we should find an appropriate event to delete an pid->pname entry in map, instead of caching the entry forever. LRU? Timer? Tracing the lifetime of a process?

LRU, don't evict, just read from the cache when you cannot get the pname from the regular conversion method?

Not sure about others, but TBH for me a process name is very little of use when debugging.

Agreed it's nice to have, but not a big issue if it's occasionally broken

from pwru.