Merge branch 'master' into failed_opens

Dockerfile.debian

+FROM debian:jessie
+
+RUN apt-key adv --keyserver ha.pool.sks-keyservers.net --recv 15CF4D18AF4F7421 && \
+    echo "deb http://llvm.org/apt/jessie/ llvm-toolchain-jessie-3.8 main" > /etc/apt/sources.list.d/llvm.list && \
+    apt-get update && \
+    apt-get install -y --no-install-recommends build-essential fakeroot bison cmake debhelper devscripts flex git libedit-dev python zlib1g-dev libllvm3.8 llvm-3.8-dev libclang-3.8-dev libelf-dev luajit libluajit-5.1-dev && \
+    mkdir -p /usr/share/llvm-3.8 && \
+    ln -s /usr/lib/llvm-3.8/share/llvm/cmake /usr/share/llvm-3.8/cmake
+
+COPY ./ /root/bcc
+
+WORKDIR /root/bcc
+
+RUN ./scripts/build-deb.sh

tools/fileslower.py

@@ -187,9 +187,14 @@ b = BPF(text=bpf_text)
 # the parent functions, at the cost of more overhead, instead.
 # Ultimately, we should be using [V]FS tracepoints.
 b.attach_kprobe(event="__vfs_read", fn_name="trace_read_entry")
-b.attach_kprobe(event="__vfs_write", fn_name="trace_write_entry")
 b.attach_kretprobe(event="__vfs_read", fn_name="trace_read_return")
-b.attach_kretprobe(event="__vfs_write", fn_name="trace_write_return")
+try:
+    b.attach_kprobe(event="__vfs_write", fn_name="trace_write_entry")
+    b.attach_kretprobe(event="__vfs_write", fn_name="trace_write_return")
+except:
+    # older kernels don't have __vfs_write so try vfs_write instead
+    b.attach_kprobe(event="vfs_write", fn_name="trace_write_entry")
+    b.attach_kretprobe(event="vfs_write", fn_name="trace_write_return")
 
 TASK_COMM_LEN = 16  # linux/sched.h
 DNAME_INLINE_LEN = 32  # linux/dcache.h