Skip to content

Conversation

@kylebartush-twitter
Copy link
Contributor

@kylebartush-twitter kylebartush-twitter commented Sep 14, 2021

Provides telemetry to track MIT kerberos ticket requests served by the krb5kdc binary. This is accomplished by attaching user space probes to the following functions: finish_process_as_req, finish_dispatch_cache and process_tgs_req. Each function exports a call count that is broken down by the resulting error code. Since there is a very large list of possible error codes, the first 30 error codes are exported. All other error code values are exported as UNKNOWN.

Each error code is reformatted to better fit metric naming standards: "KRB5KDC_ERR_BAD_PVNO" -> "bad_pvno"

krb5kdc/finish_process_as_req/{ERROR_CODE} - count of finish_process_as_req calls by error
krb5kdc/finish_dispatch_cache/{ERROR_CODE} - count of finish_dispatch_cache calls by error
krb5kdc/process_tgs_req/{ERROR_CODE} - count of process_tgs_req calls by error

- The krb5_error_code is actually the second parameter to each function
- Clean up some of the extra bpf code
- krb5_error_code is actually an old format and needed to be translated
based on the u64 put on the stack for the function call.
@kylebartush-twitter kylebartush-twitter marked this pull request as ready for review September 14, 2021 23:27
Copy link
Contributor

@brayniac brayniac left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me

@brayniac brayniac merged commit 87bc7ac into twitter:master Sep 16, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants