Re: [PATCH] coredump: add tracepoint for coredump events

On Fri, Mar 20, 2026 at 02:21:48PM +0100, Christian Brauner wrote:

On Fri, 20 Mar 2026 05:33:34 -0700, Breno Leitao wrote:

quoted

Coredump is a generally useful and interesting event in the lifetime
of a process. Add a tracepoint so it can be monitored through the
standard kernel tracing infrastructure.

BPF-based crash monitoring is an advanced approach that
allows real-time crash interception: by attaching a BPF program at
this point, tools can use bpf_get_stack() with BPF_F_USER_STACK to
capture the user-space stack trace at the exact moment of the crash,
before the process is fully terminated, without waiting for a
coredump file to be written and parsed.

[...]

"stable" with a grain of salt. We make no such guarantees that it won't be
moved around if needed.

Ack. At least tracepoints offer more stability compared to
fentry/function-based approaches which can be inlined, renamed, or
otherwise modified.

Thanks for reviewing this.
--breno