On Thu, 2026-10-22 at 10:25 +0200, Nam Cao wrote: > What about we refactor the in-kernel monitors' trace events into a > single one. I am picturing two functions for ALL classes and ALL > monitors: > > void rv_error(const char *monitor_name, const char *message); > void rv_event(const char *monitor_name, const char *message); > > which trigger the tracepoints. And we make those kfuncs. This allows > sharing trace events between in-kernel monitors and BPF monitors. > > Then everything else (kernel reactors, users, perhaps even eBPF reactors > in the future) hook into those tracepoints.
That could work, though we'd lose some ergonomics around filtering events, not so much in the unified tracepoint thing but in what fields events have. We would need to parse a string (so I wonder if globs can express constraints like matching whole words or we'd need to arrange the format to accommodate glob limitations). On the other hand if we still want to keep fields, we are going to need event/error pairs for both DA and LTL and a way to match monitors with their class (needed if you want to surgically enable the right events for your monitors). Both can work and what you propose is clearly simpler to implement, I can have a look. Thanks, Gabriele
