[Enhancement] Troubeshooting tools

[linglilongyi]

solution 1:
save bpf event before formatting until get free
solution 2:
save bpf events in kernel as a map of u64 to arraies, push them into user mode when the skb is free by kernel.

input &ev
save them until __kfree_skb()
reference: https://sigma-star.at/blog/2023/11/ftrace-skb-drop/

dae/trace/kern/trace.c

Line 215 in 4717fa2

bpf_ringbuf_output(&events, &ev, sizeof(ev), 0);