How to detach uprobes with invalid `/proc/fs` binary path after process terminates? about bcc HOT 4 OPEN

Another way of phrasing this question: how do we detach uprobes for short-lived processes/containers? What is the expected way to manage the uprobe lifecycle on containerized (ephemeral) applications?

from bcc.

Could a BCC maintainer please comment on this?

It would be neat to have BCC track the open probes so that the binary can be removed from the file system and the probe can still be detached. For example, BCC could return a probe descriptor which internally could map to the open FDs. When the user calls detach probe, internally BCC uses the probe descriptor to find the aforesaid FDs and then closes them.

from bcc.

For uprobe, current bcc has a mapping 'ev_name -> fd'. When detaching happens, bcc will follow 'ev_name -> fd' mapping and find the 'fd' and do detaching. I need to double check whether 'fd' (created at 'attach'/perf_event_open point) is still valid or not for short-lived process. Do you have an example to show the issue?

from bcc.

We will craft an example. Thank you!

from bcc.