Exit probe is too early, and we end up getting file descriptor closing events after exit.

[haesbaert]

Severity

Minor

Affects Version(s)

8.5.0, 8.5.1, 8.6.0

Epic/Meta Issue

No response

Kernel Version(s)

lala

Linux Distro

all

Fix Versions

No response

Description

We trap exit at taskstats_exit(), but it happens before exit_files(). We should move the trap down to something like proc_exit_connector().

The bug is that if you make a connection and kill the process, we will see EXIT and then CLOSE, instead of CLOSE and EXIT, which is bad.
This has been present since the very beginning.

From quark:

1019440 EBPF EXIT 286138622411993
1019440 EBPF CLOSE 286138622618725
->1019440 (EXIT) (286138622411993)
  COMM  comm=nc
  CMDL  cmdline=[ nc, sam, 12345 ]
  PROC  ppid=984938
  PROC  uid=1000 gid=1000 suid=1000 sgid=1000 euid=1000 egid=1000 pgid=1019440 sid=984938
  PROC  cap_inheritable=0x0 cap_permitted=0x0 cap_effective=0x0
  PROC  cap_bset=0x0 cap_ambient=0x0
  PROC  time_boot=1738080692747109130 tty_major=136 tty_minor=6
  PROC  uts_inonum=4026531838 ipc_inonum=4026531839
  PROC  mnt_inonum=4026531841 net_inonum=4026531840
  PROC  entry_leader_type=UNKNOWN entry_leader=0
  CWD   cwd=/d/e/quark
  FILE  filename=/usr/bin/nc
  EXIT  exit_code=0 exit_time=1738080698622411993
->1019440 (SOCK_CONN_CLOSED) (286138622618725)
  NET   local=192.168.8.150:58210 remote=192.168.8.111:12345
  COMM  comm=nc
  CMDL  cmdline=[ nc, sam, 12345 ]
  PROC  ppid=984938
  PROC  uid=1000 gid=1000 suid=1000 sgid=1000 euid=1000 egid=1000 pgid=1019440 sid=984938
  PROC  cap_inheritable=0x0 cap_permitted=0x0 cap_effective=0x0
  PROC  cap_bset=0x0 cap_ambient=0x0
  PROC  time_boot=1738080692747109130 tty_major=136 tty_minor=6
  PROC  uts_inonum=4026531838 ipc_inonum=4026531839
  PROC  mnt_inonum=4026531841 net_inonum=4026531840
  PROC  entry_leader_type=UNKNOWN entry_leader=0
  CWD   cwd=/d/e/quark
  FILE  filename=/usr/bin/nc
  EXIT  exit_code=0 exit_time=1738080698622411993