ebpf运行报错modprobe: FATAL: Module kheaders not found.

eBPF示例

#!/usr/bin/python3

from bcc import BPF

# This may not work for 4.17 on x64, you need replace kprobe__sys_clone with kprobe____x64_sys_clone
prog = """
	int kprobe__sys_clone(void *ctx) {
		bpf_trace_printk("Hello, World!\\n");
		return 0;
	}
"""

b = BPF(text=prog, debug=0x04)
b.trace_print()

运行eBPF程序是，出现以下错误

# python hello.py
modprobe: FATAL: Module kheaders not found.
Running from kernel directory at: /lib/modules/3.10.0-1160.el7.x86_64/build
chdir(/lib/modules/3.10.0-1160.el7.x86_64/build): No such file or directory
Traceback (most recent call last):
  File "hello.py", line 13, in <module>
    b = BPF(text=prog, debug=0x04)
  File "/usr/lib/python2.7/site-packages/bcc/__init__.py", line 325, in __init__
    raise Exception("Failed to compile BPF text")
Exception: Failed to compile BPF text

结果发现是内核版本不支持，需要升级内核到4.6版本以上

# uname -r
3.10.0-1160.el7.x86_64