vmware
Investigate BPF Ring Buffer Map Usage
If we can programmatically detect the BPF Map ring buffer type via BCC or a capability BPF syscall test or very worst case a kernel version check in userspace, then we should attempt to use this for most if not all events. The perf output buffers work but there is a limit to scalability and ease of weaving BPF events together.
There is a limitation of the perf ring buffer. If the BPF program produces events at a speed on perf ring buffer faster than any application code can process them, some events will be lost (overwritten since it's a ring). The Possibly lost XX samples message is a notification of this happening.
Yes. One of the main reasons to switch the BPF Map based ring buffer when available. Since all of our events are tied to a single perf buffer across the multiple CPUs, we should benefit from using the BPF Map ring buffer.
Another option would be to throw more non-essential events into a secondary perf buffer.