GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — ebpf.plugin: stop the tracked PID count from growing under churn by stelfrag · Pull Request #24423 · netdata/netdata

Conversation

stelfrag commented Oct 25, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Collaborator

Summary

ebpf.monitoring_pid "user" (ebpf_all_pids_count) only grew on hosts with short-lived processes.

ebpf_del_pid_entry() decremented the counter only when thread_collecting & NETDATA_EBPF_PIDS_PROC_FILE (the enum value 8, while the stored bit is 1 << 8) or has_proc_file was set. A PID whose /proc/PID/stat vanished before it was read has has_proc_file == 0, so it was freed without being subtracted.

Every entry linked into the PID list is counted when it is linked, and both delete paths walk that list, so the decrement is now unconditional.
ebpf_get_pid_data() takes only the PID (its single caller always passed tgid=0, name=NULL, idx=PROC_FILE); the unused thread_collecting field, the ebpf_reset_specific_pid_data() wrapper and the now-unused NETDATA_EBPF_PIDS_PROC_FILE enum value (trailing; other indices unchanged) are removed.
The counter is accessed atomically: the process thread reads it without the mutex the main thread updates it under.

Test

ebpf.plugin (Debug + ASAN, process module, apps = yes) under 90 s of short-lived process churn, same instrumentation on both builds:

	linked PIDs	counter	`SET user`
master	362	481 (drift grows every cycle)	482
this PR	309	309 (drift 0 on all 14 cycles)	323 (= linked at that cycle)

No ASAN reports on either build.

Summary by CodeRabbit

Bug Fixes
- Improved consistency of process count metrics during monitoring.
- Exited processes and processes confirmed absent are now removed from tracking, helping keep process data current.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          ebpf.plugin: stop the tracked PID count from growing under churn

50bda58

ebpf_del_pid_entry() decremented ebpf_all_pids_count only when
`thread_collecting & NETDATA_EBPF_PIDS_PROC_FILE` (the enum value, not its
bit) or has_proc_file was set, so every PID whose /proc stat vanished before
it was read was freed without being subtracted. monitoring_pid "user" grew
forever on hosts with short-lived processes.

Every linked entry is counted when it is linked, so decrement unconditionally.
Drop the dead tgid/name/idx handling and thread_collecting that hid the bug,
and access the counter atomically: the process thread reads it unlocked.

coderabbitai Bot commented Oct 25, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 02d0cd66-50ae-47a4-bd6c-d9e01d56b816

Commits

Reviewing files that changed from the base of the PR and between c5aec5a and 50bda58.

Files selected for processing: 5

src/collectors/collectors-ipc/ebpf-ipc.h
src/collectors/ebpf.plugin/ebpf.c
src/collectors/ebpf.plugin/ebpf_apps.c
src/collectors/ebpf.plugin/ebpf_apps.h
src/collectors/ebpf.plugin/ebpf_process.c

Files with no reviewable changes: 1

src/collectors/collectors-ipc/ebpf-ipc.h

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

Walkthrough

The change updates PID entry creation and cleanup, removes the PID collection flag and reset helper, and changes PID count reads to use relaxed atomic loads.

Changes: PID Tracking

Layer / File(s)	Summary
PID entry lifecycle `src/collectors/ebpf.plugin/ebpf_apps.h`, `src/collectors/collectors-ipc/ebpf-ipc.h`, `src/collectors/ebpf.plugin/ebpf_apps.c`	The PID entry API no longer accepts collection metadata, and the `thread_collecting` field and reset helper are removed. PID cleanup now deletes entries, and deletion always decrements the count.
PID count reads `src/collectors/ebpf.plugin/ebpf_apps.c`, `src/collectors/ebpf.plugin/ebpf.c`, `src/collectors/ebpf.plugin/ebpf_process.c`	The user PID metric and process collector use relaxed atomic loads to read the PID count. The count comment now identifies module-thread atomic reads.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: thiagoftsm

Merge Risk: Minimal · up to 50bda

The PID-count change appears mergeable after normal checks; no actionable issue was established.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: preventing the tracked PID count from increasing incorrectly during process churn.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 4 files.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

github-actions Bot added area/collectors

Everything related to data collection

collectors/ebpf labels

Oct 25, 2026

sonarqubecloud Bot commented Oct 25, 2026

Copy link

Copy Markdown

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

stelfrag marked this pull request as ready for review

October 26, 2026 15:48

stelfrag requested a review from thiagoftsm as a code owner

October 26, 2026 15:48

thiagoftsm approved these changes

Oct 26, 2026

View reviewed changes

thiagoftsm left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR is running as expected on Debian 12. LGTM!

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

stelfrag merged commit 4b28b5d into netdata:master

Oct 26, 2026

160 of 161 checks passed

Uh oh!

There was an error while loading. Please reload this page.

stelfrag deleted the fix-ebpf-pid-count branch

October 26, 2026 20:00

stelfrag added a commit to stelfrag/netdata that referenced this pull request

Oct 27, 2026


          ebpf.plugin: stop the tracked PID count from growing under churn (net…

fdb1d8c

…data#24423)

ebpf_del_pid_entry() decremented ebpf_all_pids_count only when
`thread_collecting & NETDATA_EBPF_PIDS_PROC_FILE` (the enum value, not its
bit) or has_proc_file was set, so every PID whose /proc stat vanished before
it was read was freed without being subtracted. monitoring_pid "user" grew
forever on hosts with short-lived processes.

Every linked entry is counted when it is linked, so decrement unconditionally.
Drop the dead tgid/name/idx handling and thread_collecting that hid the bug,
and access the counter atomically: the process thread reads it unlocked.

(cherry picked from commit 4b28b5d)

stelfrag mentioned this pull request

Oct 26, 2026

Patch release 2.12.3 #24442

Merged

Ferroin pushed a commit that referenced this pull request

Nov 4, 2026


          ebpf.plugin: stop the tracked PID count from growing under churn (#24423

f63d907

)

ebpf_del_pid_entry() decremented ebpf_all_pids_count only when
`thread_collecting & NETDATA_EBPF_PIDS_PROC_FILE` (the enum value, not its
bit) or has_proc_file was set, so every PID whose /proc stat vanished before
it was read was freed without being subtracted. monitoring_pid "user" grew
forever on hosts with short-lived processes.

Every linked entry is counted when it is linked, so decrement unconditionally.
Drop the dead tgid/name/idx handling and thread_collecting that hid the bug,
and access the counter atomically: the process thread reads it unlocked.

(cherry picked from commit 4b28b5d)

Reviewers

thiagoftsm

thiagoftsm approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

area/collectors

Everything related to data collection

collectors/ebpf

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

stelfrag commented Oct 25, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud Bot commented Oct 25, 2026

Quality Gate passed

Uh oh!

thiagoftsm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

stelfrag commented Oct 25, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

coderabbitai Bot commented Oct 25, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.