1
cat > trace_open.c << 'EOF'
2
#include <uapi/linux/ptrace.h>
3
#include <linux/fs.h>
4

5
struct event {
6
    u32 pid;
7
    char comm[16];
8
    char filename[256];
9
};
10

11
BPF_PERF_OUTPUT(events);
12

13
int trace_open(struct pt_regs *ctx, struct file *file) {
14
    struct event e = {};
15
    u32 pid = bpf_get_current_pid_tgid() >> 32;
16
    e.pid = pid;
17
    bpf_get_current_comm(&e.comm, sizeof(e.comm));
18
    bpf_probe_read_kernel(&e.filename, sizeof(e.filename), file->f_path.dentry->d_name.name);
19
    events.perf_submit(ctx, &e, sizeof(e));
20
    return 0;
21
}
22
EOF
23

24
clang -O2 -target bpf -c trace_open.c -o trace_open.o
25

26
# python trace_open.py

1
bpftrace -e '
2
    kprobe:tcp_v4_connect {
3
        printf("PID=%d COMM=%s: tcp_v4_connect called\n", pid, comm);
4
    }
5
    kretprobe:tcp_v4_connect {
6
        printf("PID=%d COMM=%s: tcp_v4_connect returned %d\n", pid, comm, retval);
7
    }
8
'

1
bpftrace -l 'tracepoint:*'

1
bpftrace -e '
2
    uprobe:/app/order-service:net/http.(*conn).serve {
3
        printf("HTTP request started: PID=%d\n", pid);
4
    }
5
    uretprobe:/app/order-service:net/http.(*conn).serve {
6
        printf("HTTP request completed: PID=%d\n", pid);
7
    }
8
'

1
routes:
2
  patterns:
3
    - name: "HTTP"
4
      match:
5
        kind: "HTTP"
6
        operations: ["GET", "POST", "PUT", "DELETE"]
7
    - name: "gRPC"
8
      match:
9
        kind: "gRPC"
10

11
export:
12
  otel:
13
    endpoint: "otel-collector:4317"
14
    protocol: "grpc"
15
    traces:
16
      enabled: true
17
    metrics:
18
      enabled: true
19

20
discovery:
21
  services:
22
    - name: "order-service"
23
      namespace: "production"
24
      pod_labels:
25
        app: "order-service"

1
# Beyla DaemonSet
2
apiVersion: apps/v1
3
kind: DaemonSet
4
metadata:
5
  name: beyla
6
spec:
7
  selector:
8
    matchLabels:
9
      app: beyla
10
  template:
11
    spec:
12
      serviceAccountName: beyla
13
      containers:
14
        - name: beyla
15
          image: grafana/beyla:latest
16
          securityContext:
17
            capabilities:
18
              add: ["CAP_BPF", "CAP_SYS_PTRACE"]
19
          env:
20
            - name: BEYLA_OTEL_ENDPOINT
21
              value: "otel-collector:4317"
22
            - name: BEYLA_DISCOVERY
23
              value: "auto"

1
on_sys_enter_read(ctx) {
2
    buf = read_buffer(ctx);
3
    method = parse_http_method(buf);     # "GET"
4
    path = parse_http_path(buf);         # "/api/orders"
5

6
    request_map[conn_id] = {
7
        method: method,
8
        path: path,
9
        start_time: bpf_ktime_get_ns()
10
    };
11
}
12

13
on_sys_enter_write(ctx) {
14
    buf = read_buffer(ctx);
15
    status = parse_http_status(buf);     # 200
16

17
    req = request_map[conn_id];
18
    duration = bpf_ktime_get_ns() - req.start_time;
19

20
    event_output({
21
        method: req.method,
22
        path: req.path,
23
        status: status,
24
        duration_ns: duration
25
    });
26
}

1
bpftrace -e '
2
    kprobe:tcp_v4_connect {
3
        printf("PID=%d COMM=%s: tcp_v4_connect called\n", pid, comm);
4
    }
5
    kprobe:tcp_v4_connect {
6
        printf("PID=%d COMM=%s: tcp_v4_connect called\n", pid, comm);
7
    }
8
'
9

10
# - tcp_connection_opened_total
11
# - tcp_connection_closed_total
12
# - tcp_connection_duration_seconds
13
# - tcp_retransmissions_total

1
bpftrace -e '
2
    uprobe:/app/order-service:net/http.(*conn).serve {
3
        @start[tid] = nsecs;
4
    }
5
    uretprobe:/app/order-service:net/http.(*conn).serve /@start[tid]/ {
6
        @latency = hist((nsecs - @start[tid]) / 1000000);
7
        delete(@start[tid]);
8
    }
9
'
10

11
# @latency:
12
# [1, 2)                1234 |@@@@@@@@@@                                          |
13
# [2, 4)                 567 |@@@@                                                |
14
# [4, 8)                 234 |@@                                                  |
15
# [8, 16)                 89 |                                                    |
16
# [16, 32)                45 |                                                    |
17
# [32, 64)                12 |                                                    |

1
# 追踪 TCP 连接建立
2
bpftrace -e '
3
    kprobe:tcp_v4_connect {
4
        printf("PID: %d, %s -> ", pid, comm);
5
        printf("%s\n", ntop(arg2));
6
    }
7
'
8

9
# 追踪 HTTP 请求延迟（uprobe）
10
bpftrace -e '
11
    uprobe:/app/order-service:net/http.(*conn).serve {
12
        @start[tid] = nsecs;
13
    }
14
    uretprobe:/app/order-service:net/http.(*conn).serve /@start[tid]/ {
15
        @latency = hist((nsecs - @start[tid]) / 1000000);
16
        delete(@start[tid]);
17
    }
18
'
19

20
# 追踪文件 I/O 延迟
21
bpftrace -e '
22
    kprobe:vfs_read {
23
        @start[tid] = nsecs;
24
    }
25
    kretprobe:vfs_read /@start[tid]/ {
26
        @read_ns = hist(nsecs - @start[tid]);
27
        delete(@start[tid]);
28
    }
29
'

1
# CPU 分析
2
execsnoop          # 追踪新进程创建
3
opensnoop          # 追踪文件打开
4
profile            # CPU 性能分析（类似 perf）
5

6
# 内存分析
7
memleak            # 检测内存泄漏
8
slabratetop        # 内核 SLAB 分配速率
9

10
# 网络
11
tcpconnect         # 追踪 TCP 活跃连接
12
tcpaccept          # 追踪 TCP 被动连接
13
tcpretrans         # 追踪 TCP 重传
14
tcplife            # 追踪 TCP 连接生命周期
15

16
# I/O
17
biolatency         # 块设备 I/O 延迟直方图
18
biosnoop           # 块设备 I/O 追踪
19
filelife           # 文件生命周期追踪

1
# Beyla DaemonSet 资源配置
2
resources:
3
  requests:
4
    cpu: 100m
5
    memory: 128Mi
6
  limits:
7
    cpu: 500m
8
    memory: 512Mi

1
# Beyla 最小权限配置
2
securityContext:
3
  capabilities:
4
    add: ["CAP_BPF", "CAP_SYS_PTRACE"]
5
  readOnlyRootFilesystem: true
6
  # 注意: eBPF 需要 root 权限
7
  runAsNonRoot: false
8

9
# RBAC 权限
10
rules:
11
  - apiGroups: [""]
12
    resources: ["pods"]
13
    verbs: ["get", "list", "watch"]
14
  - apiGroups: [""]
15
    resources: ["namespaces"]
16
    verbs: ["get", "list", "watch"]

1
# Kubernetes 部署
2
kubectl apply -f beyla-daemonset.yaml
3

4
# 验证 Beyla 运行
5
kubectl logs -n monitoring daemonset/beyla

1
# 发送 HTTP 请求到应用
2
curl http://localhost:8080/api/v1/orders
3

4
# 在 Grafana 中查看自动产生的追踪
5
# 1. 打开 Grafana Explore
6
# 2. 选择 Tempo 数据源
7
# 3. 搜索 service.name = "order-service"
8
# 4. 确认能看到 Beyla 自动产生的追踪