Fixed #JiraBug28065 Euspace-mysql数据库采集问题汇总 mysql-insert异常未采集到

ebpftracer/ebpf/l7/l7.c

@@ -200,6 +200,12 @@ struct {
     __uint(max_entries, 32768);
 } active_l7_requests_dm_ctx SEC(".maps");
 
+struct {
+    __uint(type, BPF_MAP_TYPE_LRU_HASH);
+    __uint(key_size, sizeof(struct l7_request_key));
+    __uint(value_size, MYSQL_PACKAGE_HEADER_LEN);
+    __uint(max_entries, 32768);
+} active_l7_requests_mysql_resp_header_ctx SEC(".maps");
 
 struct {
      __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
@@ -955,11 +961,34 @@ int trace_exit_read(void *ctx, __u64 id, __u32 pid, __u16 is_tls, long int ret)
 //		__u64 trace_id = get_apm_trace_id(pid, tid);
 //        cw_bpf_debug("[Mysql] trace_id:%llu", trace_id);
 //		e->trace_id = trace_id;
+
+        //response package parsing partial data (such as by header)
+        if(ret == MYSQL_PACKAGE_HEADER_LEN) {
+              //sava header to ctx and return
+             char resp_packet_header[MYSQL_PACKAGE_HEADER_LEN];
+             bpf_probe_read(resp_packet_header,MYSQL_PACKAGE_HEADER_LEN, payload);
+             bpf_map_update_elem(&active_l7_requests_mysql_resp_header_ctx, &k, resp_packet_header, BPF_ANY);
+             bpf_map_update_elem(&active_l7_requests, &k, req, BPF_ANY);
+             return 0 ;
+        }
+
         e->component_sport = conn->sport;
         e->component_dport = conn->dport;
         __builtin_memcpy(&e->component_saddr, &conn->saddr, sizeof(e->component_saddr));
         __builtin_memcpy(&e->component_daddr, &conn->daddr, sizeof(e->component_daddr));
-		response = is_mysql_response(payload, ret, req->request_type, &e->statement_id, &e->status);
+
+        char* resp_packet_header = bpf_map_lookup_elem(&active_l7_requests_mysql_resp_header_ctx, &k);
+        if(resp_packet_header) {
+            char resp_combined_packet[5];
+            bpf_probe_read(resp_combined_packet,MYSQL_PACKAGE_HEADER_LEN, resp_packet_header);
+            bpf_probe_read(&resp_combined_packet[4],1, payload);
+            response = is_mysql_response(resp_combined_packet,sizeof(resp_combined_packet), req->request_type, &e->statement_id, &e->status);
+            if(response) {
+                 bpf_map_delete_elem(&active_l7_requests_mysql_resp_header_ctx, &k);
+            }
+        } else {
+            response = is_mysql_response(payload, ret, req->request_type, &e->statement_id, &e->status);
+        }
 		if (req->request_type == MYSQL_COM_STMT_PREPARE) {
 			e->method = METHOD_STATEMENT_PREPARE;
 		}

ebpftracer/ebpf/l7/mysql.c

@@ -8,6 +8,8 @@
 #define MYSQL_RESPONSE_EOF   0xfe
 #define MYSQL_RESPONSE_ERROR 0xff
 
+#define MYSQL_PACKAGE_HEADER_LEN 4
+
 
 static __always_inline
 int is_mysql_query(char *buf, __u64 buf_size, __u8 *request_type) {
@@ -21,6 +23,7 @@ int is_mysql_query(char *buf, __u64 buf_size, __u8 *request_type) {
         return 0;
     }
     if (b[4] ==  MYSQL_COM_QUERY || b[4] == MYSQL_COM_STMT_EXECUTE) {
+        *request_type = b[4];
         return 1;
     }
     if (b[4] == MYSQL_COM_STMT_CLOSE) {