File Expiration Using BPF
hondu.co
File Expiration Using BPF
1–10 of 24 posts
Re: File Expiration Using BPF
#2BPF --> Berkley Packet Filter
Maybe this comment will save you a google. But probably not.
Re: File Expiration Using BPF
#3This seems a little roundabout. Why is this preferable over using `inotify(7)`? That's an existing system which can notify your userspace driver program about any time `setxattr(2)` is called.
I get that it's fun to experiment with BPF, but it's also useful to see how many tools already exist. BPF is powerful, yes - maybe too powerful, and it's often not the best tool for the job.
Re: File Expiration Using BPF
#4This seems a little roundabout. Why is this preferable over using `inotify(7)`? That's an existing system which can notify your userspace driver program about any time `setxattr(2)` is called. I get that it's fun to experiment with BPF, but it's also useful to see how many tools already exist. BPF is powerful, yes - maybe too powerful, and it's often not the best tool for the job.
Here you probably want fanotify, not inotify. The later would require setting up a lot of inotify entries, recursing through the filesystem.
https://man7.org/linux/man-pages/man7/fanotify.7.html
I think fanotify does xattrs, but I haven't tested.
Re: File Expiration Using BPF
#5Quite clearly from the "solution looking for a problem" dept.
If one ever happenes to casually find 'several petabytes of old logs that were not deleted', whoever's in charge should consider having several people fired over that.
Re: File Expiration Using BPF
#6Author here! As some comments mention, there are other approaches that could make more sense.
The aim of this proof-of-concept was to showcase how BPF enables the kernel to be programmable. Many behaviours can be retrofitted without having to submit changes upstream. In some cases the overhead may be lower than using other methods (due to avoiding context switches, etc). Even if you decide that the changes can be useful for the broader community, the new feature can be first implemented in BPF, where it’s faster (and safer!) to evolve it.
Re: File Expiration Using BPF
#7This seems a little roundabout. Why is this preferable over using `inotify(7)`? That's an existing system which can notify your userspace driver program about any time `setxattr(2)` is called. I get that it's fun to experiment with BPF, but it's also useful to see how many tools already exist. BPF is powerful, yes - maybe too powerful, and it's often not the best tool for the job.
Here you probably want fanotify, not inotify. The later would require setting up a lot of inotify entries, recursing through the filesystem. https://man7.org/linux/man-pages/man7/fanotify.7.html I think fanotify does xattrs, but I haven't tested.
Exactly this. I should have mentioned it in the post. Might amend it.
Would be interesting to compare the chances of race conditions with inotify vs BPF for this contrived use-case.
Re: File Expiration Using BPF
#8BPF --> Berkley Packet Filter Maybe this comment will save you a google. But probably not. https://en.wikipedia.org/wiki/Berkeley_Packet_Filter
Funnily enough, although this calls it BPF, the technology in the article refers to eBPF (https://en.wikipedia.org/wiki/EBPF): https://docs.kernel.org/bpf/index.html -- which, although rooted in the OG BPF, is only distantly related.
Re: File Expiration Using BPF
#9Quite clearly from the "solution looking for a problem" dept. If one ever happenes to casually find 'several petabytes of old logs that were not deleted', whoever's in charge should consider having several people fired over that.
You'd fire people for leaving around some log files?
Re: File Expiration Using BPF
#10Quite clearly from the "solution looking for a problem" dept. If one ever happenes to casually find 'several petabytes of old logs that were not deleted', whoever's in charge should consider having several people fired over that.
[dead]