microsoft / microsoft/retina

Document PR #1981 (packetparser ring buffer support)

Open
#2,016 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
3.2k
Forks
304
Avg merge
1d 16h
Merged PRs (30d)
79

Description

## Summary
Document the changes from PR microsoft/retina#1981, which adds configurable BPF ring buffer support for the packetparser plugin as an alternative to perf event arrays.

## Changes to Capture
- Configuration: added `enablePacketParserRingBuffer` (bool) and `packetParserRingBufferSize` (uint32) in config and Helm values.
- BPF: packetparser BPF program can compile with `BPF_MAP_TYPE_RINGBUF` when enabled.
- Userspace: packetparser uses a ring buffer reader via a wrapper to conform to the existing reader interface and logs which buffer type is active.
- Build flags: BPF compilation adds `-DUSE_RING_BUFFER` and `-DRING_BUFFER_SIZE` when enabled.
- Tests: updated unit tests and added coverage for ring buffer compilation.

## Verification Notes
- Unit tests: `go test -v ./pkg/plugin/packetparser/...`
- Manual: Kind deployment with ring buffer enabled, logs show ring buffer reader, `bpftool` shows map type `ringbuf`.
- Verify metrics are generated as expected.

## Related
- Issue: https://github.com/microsoft/retina/issues/1966
- Issue: https://github.com/microsoft/retina/issues/655
- PR: https://github.com/microsoft/retina/pull/1965

## Open Questions / Follow-ups
- Consider a tri-state config (auto/enabled/disabled) once runtime decision logic exists.
- Implement auto mode so Retina decides the map type at runtime.
- Document pros/cons and guidance for choosing ring buffer vs perf array.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.