The OVS section captures OpenvSwitch datapath events, providing visibility into packet processing, upcalls to userspace, flow operations, and action execution.
Event Types The OVS section uses a tagged union with an event_type field that determines which event structure is present:
Type of OVS event. One of:
"upcall" - Upcall initiated from kernel to userspace"upcall_enqueue" - Packet enqueued for userspace processing"upcall_return" - Upcall completed"recv_upcall" - Userspace received the upcall"flow_operation" - Userspace flow operation (put/exec)"action_execute" - Datapath action execution"flow_lookup" - Datapath flow lookup result Upcall Event Indicates the start of an upcall from kernel datapath to userspace.
OVS packet command:
0 = UNSPEC1 = MISS (flow table miss)2 = ACTION (explicit userspace action)3 = EXEC (execute in userspace) Datapath port number where packet arrived.
CPU ID where upcall was initiated.
Display: upcall (miss) port 1 cpu 0Upcall Enqueue Event Packet (or fragment) enqueued for userspace processing.
Show Upcall Enqueue Fields
Return code. Non-zero indicates failure (likely packet drop).
Command type (see Upcall Event).
Timestamp of the original upcall.
CPU where upcall was initiated.
Tracking ID for correlating events.
Display: upcall_enqueue (miss) (0/7322460997041) q 1234 ret 0Upcall Return Event Upcall completed and returned to kernel.
Show Upcall Return Fields
Timestamp of the original upcall.
CPU where upcall was initiated.
Return value from upcall.
Display: upcall_ret (0/7322460997041) ret 0Receive Upcall Event Userspace received and is processing the upcall.
Show Receive Upcall Fields
Timestamp when batch processing started.
Position within the batch.
Display: upcall_recv q 1234 pkt_size 98Flow Operation Event Userspace flow operation (install flow or execute actions).
Show Flow Operation Fields
Operation type:
"exec" - Execute actions without installing flow"put" - Install flow in datapath Display: flow_put q 1234 ts 7322460997041 (0)Action Execute Event Datapath executing an action on a packet.
Show Action Execute Fields
Specific action being executed (see Action Types below).
Recirculation ID for packet reprocessing.
Tracking ID (if action came from upcall).
Display: exec oport 2 or [recirc_id 0x10] exec ct zone 5Flow Lookup Event Result of a datapath flow table lookup.
Flow pointer (0 indicates miss).
Unique Flow ID (UUID format).
Number of mask table lookups.
Datapath flow string representation.
OpenFlow flow rules that generated this datapath flow.
Flow hit: flow hit ufid 12345678-abcd-ef00-1234-567890abcdef mask 1 cache 0Flow miss: flow miss mask 3 cache 2Action Types The action field in Action Execute events can be one of:
output - Send packet to port
userspace - Send to userspace
recirc - Recirculate packet
ct - Connection tracking
zone_id: CT zoneflags: CT flagsnat: NAT configuration (optional)
set / set_masked - Set tunnel metadata
push_vlan / pop_vlan - VLAN manipulation
push_mpls / pop_mpls - MPLS manipulation
sample - Sample packet
hash - Hash packet
trunc - Truncate packet
push_eth / pop_eth - Ethernet header manipulation
ct_clear - Clear CT information
meter - Rate limiting
clone - Clone packet
drop - Explicit drop
Example JSON Upcall (Flow Miss) { "ovs" : { "event_type" : "upcall" , "cmd" : 1 , "port" : 4195744766 , "cpu" : 0 } }
Flow Lookup Hit { "ovs" : { "event_type" : "flow_lookup" , "flow" : 18446623349161350912 , "sf_acts" : 18446623349161360000 , "ufid" : [ 305419896 , 2863311530 , 1431655765 , 2863311530 ], "n_mask_hit" : 1 , "n_cache_hit" : 0 , "dpflow" : "recirc_id(0),in_port(1),eth_type(0x0800),ipv4(src=10.0.1.100,dst=10.0.2.200)" , "ofpflows" : [ "table=0, priority=100,ip,nw_src=10.0.1.0/24 actions=output:2" ] } }
Action Execute (Output) { "ovs" : { "event_type" : "action_execute" , "action" : { "action" : "output" , "port" : 2 }, "recirc_id" : 0 , "queue_id" : 1361394472 } }
Action Execute (CT with NAT) { "ovs" : { "event_type" : "action_execute" , "action" : { "action" : "ct" , "zone_id" : 20 , "flags" : 485 , "nat" : { "dir" : "dst" , "min_addr" : "10.244.1.3" , "max_addr" : "10.244.1.30" , "min_port" : 36895 , "max_port" : 36900 } }, "recirc_id" : 34 , "queue_id" : null } }
Flow Operation (Put) { "ovs" : { "event_type" : "flow_operation" , "op_type" : "put" , "queue_id" : 3316322986 , "batch_ts" : 61096237019698 , "batch_idx" : 0 } }
When This Section Appears The OVS section is populated when:
The ovs collector is enabled (-c ovs)
OpenvSwitch kernel module is loaded
Packets traverse OVS bridges
OVS probes are attached
Correlating Events Use tracking fields to correlate related events:
queue_id - Links upcall_enqueue, recv_upcall, flow_operation, and action_executeupcall_ts + upcall_cpu - Links upcall, upcall_returnrecirc_id - Tracks packet recirculationufid - Identifies flows across lookup and flow_operation events
Example Event Flow 1. upcall (miss) port 1 cpu 0 2. upcall_enqueue (miss) (0/7322460997041) q 1234 ret 0 3. upcall_recv q 1234 pkt_size 98 4. flow_put q 1234 ts 7322461000000 (0) 5. exec oport 2 q 1234 6. upcall_ret (0/7322460997041) ret 0 7. flow hit ufid 12345678-abcd-... mask 1 cache 0 8. exec oport 2
The OVS collector provides deep visibility into OpenvSwitch packet processing. Combine with skb and skb-tracking collectors to see both OVS decisions and actual packet data.
