{"id":15056957,"url":"https://github.com/tpapagian/go-ebpf-timer","last_synced_at":"2026-03-16T20:34:35.102Z","repository":{"id":234140302,"uuid":"771414632","full_name":"tpapagian/go-ebpf-timer","owner":"tpapagian","description":"An example to demonstrate the use of eBPF timers.","archived":false,"fork":false,"pushed_at":"2024-03-13T09:02:05.000Z","size":59,"stargazers_count":2,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-01-21T04:28:10.504Z","etag":null,"topics":["ebpf","golang","timers"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tpapagian.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-03-13T09:01:21.000Z","updated_at":"2024-12-06T12:33:06.000Z","dependencies_parsed_at":null,"dependency_job_id":"44c8bc04-98b0-483e-805b-496eed8af155","html_url":"https://github.com/tpapagian/go-ebpf-timer","commit_stats":null,"previous_names":["tpapagian/go-ebpf-timer"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tpapagian%2Fgo-ebpf-timer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tpapagian%2Fgo-ebpf-timer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tpapagian%2Fgo-ebpf-timer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tpapagian%2Fgo-ebpf-timer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tpapagian","download_url":"https://codeload.github.com/tpapagian/go-ebpf-timer/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243558478,"owners_count":20310574,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ebpf","golang","timers"],"created_at":"2024-09-24T21:59:14.090Z","updated_at":"2025-12-29T20:05:02.327Z","avatar_url":"https://github.com/tpapagian.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# go-ebpf-timer\n\nThis is a simple set of programs to demonstrate the use of eBPF timers. It uses [cilium/ebpf](https://github.com/cilium/ebpf) to interract with eBPF subsystem, and based on [this](https://github.com/cilium/ebpf/tree/main/examples/fentry) [cilium/ebpf](https://github.com/cilium/ebpf) example.\n\nThe high-level idea is that we will initialize a timer inside an `fentry` program that is attached to the `security_file_fcntl` kernel function. This will call a function every second until we terminate the main program. We make sure that the timer will be only initialized once even if the `fentry` program is triggered more than once.\n\nIn order to trigger our eBPF program, we will use a simple program that does an `fcntl` system call to a temporary file.\n\n## Example output:\n\n### Terminal 1\n\nBuild and load the eBPF program. Next we wait for any output.\n\n```bash\n$ go generate  ./... \u0026\u0026  go run -exec sudo .\nCompiled /home/apapag/go-ebpf-timer/bpf_bpfel.o\nStripped /home/apapag/go-ebpf-timer/bpf_bpfel.o\nWrote /home/apapag/go-ebpf-timer/bpf_bpfel.go\nCompiled /home/apapag/go-ebpf-timer/bpf_bpfeb.o\nStripped /home/apapag/go-ebpf-timer/bpf_bpfeb.o\nWrote /home/apapag/go-ebpf-timer/bpf_bpfeb.go\n2024/03/13 08:46:37 Comm             PID      TGID\n2024/03/13 08:46:42 fcntl 61982    61982                  \u003c-- first call of \"go run ./fcntl/\"\n2024/03/13 08:46:48 fcntl 62089    62089                  \u003c-- second call of \"go run ./fcntl/\"\n^C2024/03/13 08:46:54 received signal, exiting..\n```\n\n### terminal 2\n\nTrigger our eBPF program (twice) by issuing an `fcntl` system call to a temporary file.\n\n```bash\n$ go run ./fcntl/\nRunning fcntl system call on /tmp/fcntl-2144782883\n$ go run ./fcntl/\nRunning fcntl system call on /tmp/fcntl-2476336141\n```\n\n### Terminal 3\n\nCheck for eBPF messages.\n\n```bash\n$ cat /sys/kernel/debug/tracing/trace_pipe\n           \u003c...\u003e-61982   [007] ....1 88204.445824: bpf_trace_printk: timer initialized  \u003c-- first call of \"go run ./fcntl/\"\n          \u003cidle\u003e-0       [007] ..s.. 88205.445843: bpf_trace_printk: timer_callback: 0\n          \u003cidle\u003e-0       [007] ..s.. 88206.445872: bpf_trace_printk: timer_callback: 0\n          \u003cidle\u003e-0       [007] ..s.. 88207.445902: bpf_trace_printk: timer_callback: 0\n          \u003cidle\u003e-0       [007] ..s.. 88208.445922: bpf_trace_printk: timer_callback: 0\n          \u003cidle\u003e-0       [007] ..s.. 88209.445950: bpf_trace_printk: timer_callback: 0\n           \u003c...\u003e-62089   [002] ....1 88210.182905: bpf_trace_printk: timer already initialized  \u003c-- second call of \"go run ./fcntl/\"\n          \u003cidle\u003e-0       [007] ..s.. 88210.445979: bpf_trace_printk: timer_callback: 0\n          \u003cidle\u003e-0       [007] ..s.. 88211.445998: bpf_trace_printk: timer_callback: 0\n          \u003cidle\u003e-0       [007] ..s.. 88212.446021: bpf_trace_printk: timer_callback: 0\n          \u003cidle\u003e-0       [007] ..s.. 88213.446064: bpf_trace_printk: timer_callback: 0\n          \u003cidle\u003e-0       [007] ..s.. 88214.446081: bpf_trace_printk: timer_callback: 0\n          \u003cidle\u003e-0       [007] ..s.. 88215.446104: bpf_trace_printk: timer_callback: 0\n^C\n```\n\n## Test Platform\n\nThis is tested on a Linux kernel 6.5 with Go 1.22.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftpapagian%2Fgo-ebpf-timer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftpapagian%2Fgo-ebpf-timer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftpapagian%2Fgo-ebpf-timer/lists"}