from the Data Deluge? A case for file filtering in eBPF Giulia Frascaria October 28, 2020 1 The data deluge on modern storage 2 Compute node CPU Network Storage node Flash The data deluge on CPU Network Storage node Flash Data DoS in reverse! 11 Compute node CPU Network Storage node Flash Data So similar yet so different ● DoS is malicious ● Data transfer is business-critical ● We 12 So similar yet so different ● DoS is malicious ● Data transfer is business-critical ● We can blindly drop DoS 13 But could we reduce data transfer size? eBPF filter-reduce 14 Filter Reduce input

Information Technology Technology Communication 10,000 + mainstream applications on cloud native, big data CND, MEC, industrial control,etc. Integrated ecosystems and extensive compatibility through distributed maintenance status. Software Package Repositories EPOL Image EUR/oepkgs/... Desktop/SDS/ DB/Big data/... kernel/glibc/ system/GCC/... Core/Base package repository Software package repository of the enablement Linux kernel x86, Arm, RISC-V GPU NPU Real-time kernel Security kernel Database Big data Resource orchestration Desktop system Industrial application ... ... openEuler OpenHarmony / DSoftBus

expressions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 1.6.5 Extracting data from text file table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 2.4.4 Searching on the package meta data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 2.5 Debian package management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 2.5.1 Archive meta data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 2

Responses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 2.13 Binding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 confusing Port and BindAddress directives are gone; only the LISTEN directive is used for IP address binding; the SERVER- NAME directive specifies the server name and port number only for redirection and vhost overwrite that file with arbitrary data. If the log files themselves are writeable (by a non-root user), then someone may be able to overwrite the log itself with bogus data. 13http://httpd.apache.org/lists

Responses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 2.13 Binding to Addresses and Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 537 10.35 Apache Module mod data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 540 10.36 Apache Module loaded, it will now set some default timeouts. • MOD DUMPIO: DUMPIOLOGLEVEL is no longer supported. Data is always logged at LOGLEVEL trace7. 1.1. UPGRADING TO 2.4 FROM 2.2 5 • On Unix platforms, piped

Responses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 2.13 Binding to Addresses and Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 537 10.35 Apache Module mod data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 540 10.36 Apache Module loaded, it will now set some default timeouts. • MOD DUMPIO: DUMPIOLOGLEVEL is no longer supported. Data is always logged at LOGLEVEL trace7. 1.1. UPGRADING TO 2.4 FROM 2.2 5 • On Unix platforms, piped

Responses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 2.13 Binding to Addresses and Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 . . . . . . . . . . . . . . . . . . . . . . . . . . . 582 CONTENTS vii 10.37 Apache Module mod data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 585 10.38 Apache Module loaded, it will now set some default timeouts. • MOD DUMPIO: DUMPIOLOGLEVEL is no longer supported. Data is always logged at LOGLEVEL trace7. • On Unix platforms, piped logging commands configured using

Responses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 2.13 Binding to Addresses and Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 . . . . . . . . . . . . . . . . . . . . . . . . . . . 582 CONTENTS vii 10.37 Apache Module mod data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 585 10.38 Apache Module loaded, it will now set some default timeouts. • MOD DUMPIO: DUMPIOLOGLEVEL is no longer supported. Data is always logged at LOGLEVEL trace7. • On Unix platforms, piped logging commands configured using

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463 15 Data export . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . to set up Zabbix to monitor your environment, from setting up hosts to getting essential data to viewing data to configuring notifications and remote commands to be executed in case of problems. Service a fast reaction to server problems. Zabbix offers excellent reporting and data visualization features based on the stored data. This makes Zabbix ideal for capacity planning. Zabbix supports both polling

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 467 15 Data export . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . to set up Zabbix to monitor your environment, from setting up hosts to getting essential data to viewing data to configuring notifications and remote commands to be executed in case of problems. Service a fast reaction to server problems. Zabbix offers excellent reporting and data visualization features based on the stored data. This makes Zabbix ideal for capacity planning. Zabbix supports both polling