Quick start
The collector runs on each machine it observes, as root, on Linux only. Docker needs no toolchain on the host: the image builds its own Rust nightly, LLVM and bpf-linker, so the first build takes a while.
Requirements
Section titled “Requirements”- Linux with eBPF and tracefs, which any recent distribution kernel has.
mount | grep tracefsshows/sys/kernel/tracing. - cgroup v2.
- Root, or a privileged container.
Build and run
Section titled “Build and run”git clone https://github.com/danielcristho/croft.gitcd croftdocker build -f deploy/docker/Dockerfile -t croft-collector .
sudo mkdir -p /var/lib/croftjust docker-upjust docker-up runs the image with the flags it needs. Without just, see Docker.
Look at what it records
Section titled “Look at what it records”docker exec -it croft-collector croft top # processes of the newest polldocker exec -it croft-collector croft stats # dataset summaryBy default only processes holding a GPU get rows. To record every process of some containers, GPU or not, set WATCH_CGROUPS:
WATCH_CGROUPS=docker-<container-id> just docker-upThe dataset is in /var/lib/croft/croft-dataset.jsonl; Dataset describes a row.