Data may be lost during transfer in eBpf

[WhatDaniel]

HI, i know ebpf a little, and i used to make some test about ebpf. If there are much more data in kernel space, and the receive process in user space is slower than ebpf, so some data which need to be transferred to user space tend to be lost. I wanna know how to solve the case.

[SeeFlowerX]

same question 😢

[cfc4n]

1. Filter and reduce the amount of data written from kernel space.
2. Increase the buffer size of ebpf map. like rd, err := perf.NewReader(em, os.Getpagesize()*64) via

   ecapture/user/module/imodule.go

   Line 193 in bf9dee6

   rd, err := perf.NewReader(em, os.Getpagesize()*64)

3. Speed up the consumption rate in user space.