93 lines
4.5 KiB
Plaintext
93 lines
4.5 KiB
Plaintext
Demonstrations of dcsnoop, the Linux bpftrace/eBPF version.
|
|
|
|
|
|
dcsnoop traces directory entry cache (dcache) lookups, and can be used for
|
|
further investigation beyond dcstat(8). The output is likely verbose, as
|
|
dcache lookups are likely frequent. For example:
|
|
|
|
# ./dcsnoop.bt
|
|
Attaching 4 probes...
|
|
Tracing dcache lookups... Hit Ctrl-C to end.
|
|
TIME PID COMM T FILE
|
|
427 1518 irqbalance R proc/interrupts
|
|
427 1518 irqbalance R interrupts
|
|
427 1518 irqbalance R proc/stat
|
|
427 1518 irqbalance R stat
|
|
483 2440 snmp-pass R proc/cpuinfo
|
|
483 2440 snmp-pass R cpuinfo
|
|
486 2440 snmp-pass R proc/stat
|
|
486 2440 snmp-pass R stat
|
|
834 1744 snmpd R proc/net/dev
|
|
834 1744 snmpd R net/dev
|
|
834 1744 snmpd R self/net
|
|
834 1744 snmpd R 1744
|
|
834 1744 snmpd R net
|
|
834 1744 snmpd R dev
|
|
834 1744 snmpd R proc/net/if_inet6
|
|
834 1744 snmpd R net/if_inet6
|
|
834 1744 snmpd R self/net
|
|
834 1744 snmpd R 1744
|
|
834 1744 snmpd R net
|
|
834 1744 snmpd R if_inet6
|
|
835 1744 snmpd R sys/class/net/docker0/device/vendor
|
|
835 1744 snmpd R class/net/docker0/device/vendor
|
|
835 1744 snmpd R net/docker0/device/vendor
|
|
835 1744 snmpd R docker0/device/vendor
|
|
835 1744 snmpd R devices/virtual/net/docker0
|
|
835 1744 snmpd R virtual/net/docker0
|
|
835 1744 snmpd R net/docker0
|
|
835 1744 snmpd R docker0
|
|
835 1744 snmpd R device/vendor
|
|
835 1744 snmpd R proc/sys/net/ipv4/neigh/docker0/retrans_time_ms
|
|
835 1744 snmpd R sys/net/ipv4/neigh/docker0/retrans_time_ms
|
|
835 1744 snmpd R net/ipv4/neigh/docker0/retrans_time_ms
|
|
835 1744 snmpd R ipv4/neigh/docker0/retrans_time_ms
|
|
835 1744 snmpd R neigh/docker0/retrans_time_ms
|
|
835 1744 snmpd R docker0/retrans_time_ms
|
|
835 1744 snmpd R retrans_time_ms
|
|
835 1744 snmpd R proc/sys/net/ipv6/neigh/docker0/retrans_time_ms
|
|
835 1744 snmpd R sys/net/ipv6/neigh/docker0/retrans_time_ms
|
|
835 1744 snmpd R net/ipv6/neigh/docker0/retrans_time_ms
|
|
835 1744 snmpd R ipv6/neigh/docker0/retrans_time_ms
|
|
835 1744 snmpd R neigh/docker0/retrans_time_ms
|
|
835 1744 snmpd R docker0/retrans_time_ms
|
|
835 1744 snmpd R retrans_time_ms
|
|
835 1744 snmpd R proc/sys/net/ipv6/conf/docker0/forwarding
|
|
835 1744 snmpd R sys/net/ipv6/conf/docker0/forwarding
|
|
835 1744 snmpd R net/ipv6/conf/docker0/forwarding
|
|
835 1744 snmpd R ipv6/conf/docker0/forwarding
|
|
835 1744 snmpd R conf/docker0/forwarding
|
|
[...]
|
|
5154 934 cksum R usr/bin/basename
|
|
5154 934 cksum R bin/basename
|
|
5154 934 cksum R basename
|
|
5154 934 cksum R usr/bin/bashbug
|
|
5154 934 cksum R bin/bashbug
|
|
5154 934 cksum R bashbug
|
|
5154 934 cksum M bashbug
|
|
5155 934 cksum R usr/bin/batch
|
|
5155 934 cksum R bin/batch
|
|
5155 934 cksum R batch
|
|
5155 934 cksum M batch
|
|
5155 934 cksum R usr/bin/bc
|
|
5155 934 cksum R bin/bc
|
|
5155 934 cksum R bc
|
|
5155 934 cksum M bc
|
|
5169 934 cksum R usr/bin/bdftopcf
|
|
5169 934 cksum R bin/bdftopcf
|
|
5169 934 cksum R bdftopcf
|
|
5169 934 cksum M bdftopcf
|
|
5173 934 cksum R usr/bin/bdftruncate
|
|
5173 934 cksum R bin/bdftruncate
|
|
5173 934 cksum R bdftruncate
|
|
5173 934 cksum M bdftruncate
|
|
|
|
The way the dcache is currently implemented, each component of a path is
|
|
checked in turn. The first line, showing "proc/interrupts" from irqbalance,
|
|
will be a lookup for "proc" in a directory (that isn't shown here). If it
|
|
finds "proc", it will then lookup "interrupts" inside net.
|
|
|
|
The script is easily modifiable to only show misses, reducing the volume of
|
|
the output. Or use the bcc version of this tool, which only shows misses by
|
|
default: https://github.com/iovisor/bcc
|