Trying to export per process network bandwidth stats under /proc/[pid]/

Trying to export per process network bandwidth stats under /proc/[pid]/

[Amos Bird]

Hello!

I'm trying to add a proc entry under /proc/[pid] in order to get 
per process network bandwidth stats. I suppose it's similar to 
/proc/[pid]/io . However I couldn't find a modular way to add 
entries under /proc/[pid]. This thread 
https://lists.kernelnewbies.org/pipermail/kernelnewbies/2011-January/000475.html 
suggests modifying the kernel which isn't practical to me. Here is 
what I've found by going through a bit of the related kernel code.

1. I need to find a way to override or hooking 
`sock_sendmsg`/`sock_recvmsg` functions with accounting variables 
like `task_io_accounting`
2. a way to add proc entries under /proc/[pid] with readops 
printing `current` netio accounting variables.

Am I on the right path of implementing this? Thanks!

--
Amos Bird
amosbird at gmail.com

Trying to export per process network bandwidth stats under /proc/[pid]/

[Greg KH]

On Sat, Jul 14, 2018 at 11:24:23AM +0800, Amos Bird wrote:
> Hello!
> 
> I'm trying to add a proc entry under /proc/[pid] in order to get per process
> network bandwidth stats. I suppose it's similar to /proc/[pid]/io . However
> I couldn't find a modular way to add entries under /proc/[pid]. This thread https://lists.kernelnewbies.org/pipermail/kernelnewbies/2011-January/000475.html
> suggests modifying the kernel which isn't practical to me. Here is what I've
> found by going through a bit of the related kernel code.
> 
> 1. I need to find a way to override or hooking `sock_sendmsg`/`sock_recvmsg`
> functions with accounting variables like `task_io_accounting`
> 2. a way to add proc entries under /proc/[pid] with readops printing
> `current` netio accounting variables.
> 
> Am I on the right path of implementing this? Thanks!

Please don't do this in /proc, that way lies madness.  There is code in
the android kernel tree that adds this type of process accounting to the
kernel, you should look at that.  It's been rejected by upstream for
valid reasons, which you should be aware of, and is currently being
rewritten to use ebpf, which might be the better solution for you in the
long run.

And yes, you will have to modify the kernel to try to achieve this, but
it's better to just go grab the android code if you want to see how this
is done instead of trying to do it on your own from scratch.

hope this helps,

greg k-h