Identity Aware Threat Detection and Network Monitoring by using eBPF Natalia Reka Ivanko, Isovalent October 28, 2020 ● ● ○ ● ○ ○ ○ ○ ● ● ● ● ● ● ● ● ○ ● ○ ○ ○ ● ● ● ○ ● ○ ○ ● ●

transparent huge pages ● GC Related ■ case study: GC sweep caused latency jitter ■ case study: Lock and NUMA aware Agenda Part I - Latency in scheduler ● The client consists of a goroutine and a channel ○ Go GC ● Unexpected latency jitter caused by GC may still exist Conclusion Case study: Lock and NUMA aware ● TiDB server CPU usage is around 60% ● Networking and IO are both OK ● Increase the benchmark columns ● The deployment does not consider NUMA ○ CPU usage is higher when binding CPUs to NUMA nodes Reproduce ● Context Switch, Minor Page Fault, and NUMA Hit Miss are related Reproduce Reproduce

automatic scheduling integration occurs, that is, Kubernetes is not aware of the underlying vSphere topology (sites, affinity groups, NUMA, etc.). This session will explain the options to gain better performance improve scheduling Using vSphere tags to define regions and zones – add cloud provider What is NUMA? How to solve potential issues with CPU and memory intensive workloads Kubernetes default resource the nodes themselves within vSphere failure domains. 11 What is NUMA? Non Uniform Memory Architecture 12 Why should you care about NUMA? Memory intensive workloads Nearly all database servers (e.g. Oracle

on the specified bus # Driver to bind against (vfio-pci or uio_pci_generic) # # Be aware that the two DPDK compatible drivers uio_pci_generic and vfio-pci are # part of linux-image-extra- the most basic numa setup for a single socket system. If you have multiple sockets you might want to define how to split your memory among them, for example -m 1024, 1024. Please be aware that DPDK will ovs-vsctl set Open_vSwitch . "other_config:dpdk-lcore-mask=0x1" # Allocate 2G huge pages (not Numa node aware) ovs-vsctl set Open_vSwitch . "other_config:dpdk-alloc-mem=2048" # group/permissions for vhost-user

• The Linux ACPI and topology driver can enumerate and create hardware topologies for CPUs, cache, NUMA, and devices, and search for hardware topology information through kernel interfaces such as sysfs Common application Linux topology driver support Arch topology Arch numa sysfs topology export Scheduling domain setup Topology-aware scheduling Migration and wakeup Load balancing Server Server 016 r • Cluster and NUMA scheduling domains are established based on the hardware topology, and the scheduler supports load balancing and migration based on hardware clusters and NUMA nodes. This fully

When using SSSD to manage kerberos logins on a Linux host, there is an attack scenario you should be aware of: KDC spoofing. The objective of the attacker is to login on a workstation that is using Kerberos virt-clone. Replace focal with the appropriate virtual machine names for your case. Warning: Please be aware that this is a full clone, therefore any sorts of secrets, keys and for example /etc/machine-id 212 epages-2048kB/nr_hugepages <== 2 And even that could – on bigger systems – be further split per Numa node. One can allocate huge pages at boot or runtime, but due to fragmentation there are no guarantees

N: the feature is not supported. • E: the feature is not GA yet (experimental) and you need to be aware of the usage limitations. Experimental features are subject to change or removal without prior notice index on columns that you do not query often. A useful secondary index can speed up queries, but be aware that it also has side effects. Each time you add an index, an additional Key-Value is added when you operate and manage TiDB clusters. 5.1.2.2 Target machines Software Version sshpass 1.06 or later numa 2.0.12 or later tar any 5.1.3 Server recommendations You can deploy and run TiDB on the 64-bit generic

N: the feature is not supported. • E: the feature is not GA yet (experimental) and you need to be aware of the usage limitations. Experimental features are subject to change or removal without prior notice index on columns that you do not query often. A useful secondary index can speed up queries, but be aware that it also has side effects. Each time you add an index, an additional Key-Value is added when you operate and manage TiDB clusters. 5.1.2.2 Target machines Software Version sshpass 1.06 or later numa 2.0.12 or later tar any 5.1.3 Server recommendations You can deploy and run TiDB on the 64-bit generic

Variable name Change type Description tidb_enable_gc_aware_memory_track �→ Modified Changes the default value from ON to OFF. Be- cause the GC- aware mem- ory track is found inaccu- rate in tests and causes the mem- ory track is dis- abled. In ad- dition, in Golang 1.19, the mem- ory tracked by the GC- aware mem- ory track does not have much impact on the overall mem- ory. 47 Variable name Change type Description N: the feature is not supported. • E: the feature is not GA yet (experimental) and you need to be aware of the usage limitations. Experimental features are subject to change or removal without prior notice

wrong results caused by plan cache for Decimal type #43311 @qw4990 • Fix the TiDB panic issue in null-aware anti join (NAAJ) due to the wrong field type check #42459 @AilinKid • Fix the issue that DML execution the feature is not supported. 86 • E: the feature is not GA yet (experimental) and you need to be aware of the usage limitations. Experimental features are subject to change or removal without prior notice index on columns that you do not query often. A useful secondary index can speed up queries, but be aware that it also has side effects. Each time you add an index, an additional Key-Value is added when you