Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
B
bcc
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
0
Merge Requests
0
Analytics
Analytics
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Commits
Issue Boards
Open sidebar
Kirill Smelkov
bcc
Commits
ee433d4e
Commit
ee433d4e
authored
Oct 28, 2017
by
4ast
Committed by
GitHub
Oct 28, 2017
Browse files
Options
Browse Files
Download
Plain Diff
Merge pull request #1383 from pchaigno/pep8
Linter cleanups
parents
fab43ed9
ae0e0257
Changes
10
Hide whitespace changes
Inline
Side-by-side
Showing
10 changed files
with
67 additions
and
58 deletions
+67
-58
tools/bashreadline.py
tools/bashreadline.py
+2
-1
tools/bpflist.py
tools/bpflist.py
+6
-3
tools/dbslower.py
tools/dbslower.py
+21
-15
tools/lib/ucalls.py
tools/lib/ucalls.py
+4
-2
tools/memleak.py
tools/memleak.py
+23
-22
tools/nfsslower.py
tools/nfsslower.py
+1
-1
tools/sslsniff.py
tools/sslsniff.py
+3
-7
tools/tcptop.py
tools/tcptop.py
+1
-1
tools/tcptracer.py
tools/tcptracer.py
+4
-4
tools/trace.py
tools/trace.py
+2
-2
No files found.
tools/bashreadline.py
View file @
ee433d4e
...
...
@@ -56,7 +56,8 @@ print("%-9s %-6s %s" % ("TIME", "PID", "COMMAND"))
def
print_event
(
cpu
,
data
,
size
):
event
=
ct
.
cast
(
data
,
ct
.
POINTER
(
Data
)).
contents
print
(
"%-9s %-6d %s"
%
(
strftime
(
"%H:%M:%S"
),
event
.
pid
,
event
.
str
.
decode
()))
print
(
"%-9s %-6d %s"
%
(
strftime
(
"%H:%M:%S"
),
event
.
pid
,
event
.
str
.
decode
()))
b
[
"events"
].
open_perf_buffer
(
print_event
)
while
1
:
...
...
tools/bpflist.py
View file @
ee433d4e
...
...
@@ -40,7 +40,8 @@ def comm_for_pid(pid):
counts
=
{}
def
parse_probes
(
typ
):
if
args
.
verbosity
>
1
:
print
(
"open %ss:"
%
typ
)
if
args
.
verbosity
>
1
:
print
(
"open %ss:"
%
typ
)
for
probe
in
open
(
"/sys/kernel/debug/tracing/%s_events"
%
typ
):
# Probes opened by bcc have a specific pattern that includes the pid
# of the requesting process.
...
...
@@ -48,8 +49,10 @@ def parse_probes(typ):
if
match
:
pid
=
int
(
match
.
group
(
1
))
counts
[(
pid
,
typ
)]
=
counts
.
get
((
pid
,
typ
),
0
)
+
1
if
args
.
verbosity
>
1
:
print
(
probe
.
strip
())
if
args
.
verbosity
>
1
:
print
(
""
)
if
args
.
verbosity
>
1
:
print
(
probe
.
strip
())
if
args
.
verbosity
>
1
:
print
(
""
)
if
args
.
verbosity
>
0
:
parse_probes
(
"kprobe"
)
...
...
tools/dbslower.py
View file @
ee433d4e
...
...
@@ -2,17 +2,18 @@
#
# dbslower Trace MySQL and PostgreSQL queries slower than a threshold.
#
# USAGE: dbslower [-v] [-p PID [PID ...]] [-b PATH_TO_BINARY] [-m THRESHOLD] {mysql,postgres}
# USAGE: dbslower [-v] [-p PID [PID ...]] [-b PATH_TO_BINARY] [-m THRESHOLD]
# {mysql,postgres}
#
# By default, a threshold of 1ms is used. Set the threshold to 0 to trace all
# queries (verbose).
#
# Script works in two different modes:
# 1) USDT probes, which means it needs MySQL and PostgreSQL built with
# queries (verbose).
#
# Script works in two different modes:
# 1) USDT probes, which means it needs MySQL and PostgreSQL built with
# USDT (DTrace) support.
# 2) uprobe and uretprobe on exported function of binary specified by
# 2) uprobe and uretprobe on exported function of binary specified by
# PATH_TO_BINARY parameter. (At the moment only MySQL support)
#
#
# If no PID or PATH_TO_BINARY is provided, the script attempts to discover
# all MySQL or PostgreSQL database processes and uses USDT probes.
#
...
...
@@ -57,12 +58,13 @@ threshold_ns = args.threshold * 1000000
mode
=
"USDT"
if
args
.
path
and
not
args
.
pids
:
if
args
.
db
==
"mysql"
:
symbols
=
BPF
.
get_user_functions_and_addresses
(
args
.
path
,
"
\
\
w+dispatch_command
\
\
w+"
)
regex
=
"
\
\
w+dispatch_command
\
\
w+"
symbols
=
BPF
.
get_user_functions_and_addresses
(
args
.
path
,
regex
)
if
len
(
symbols
)
==
0
:
print
(
"Can't find function 'dispatch_command' in %s"
%
(
args
.
path
))
exit
(
1
)
(
mysql_func_name
,
addr
)
=
symbols
[
0
]
if
mysql_func_name
.
find
(
"COM_DATA"
)
>=
0
:
...
...
@@ -71,7 +73,8 @@ if args.path and not args.pids:
mode
=
"MYSQL56"
else
:
# Placeholder for PostrgeSQL
# Look on functions initStringInfo, pgstat_report_activity, EndCommand, NullCommand
# Look on functions initStringInfo, pgstat_report_activity, EndCommand,
# NullCommand
print
(
"Sorry at the moment PostgreSQL supports only USDT"
)
exit
(
1
)
...
...
@@ -109,7 +112,7 @@ int query_start(struct pt_regs *ctx) {
#if defined(MYSQL56) || defined(MYSQL57)
/*
Trace only packets with enum_server_command == COM_QUERY
Trace only packets with enum_server_command == COM_QUERY
*/
#ifdef MYSQL56
u64 command = (u64) PT_REGS_PARM1(ctx);
...
...
@@ -148,7 +151,7 @@ int query_end(struct pt_regs *ctx) {
u64 delta = bpf_ktime_get_ns() - tempp->timestamp;
#ifdef THRESHOLD
if (delta >= THRESHOLD) {
#endif //THRESHOLD
#endif //THRESHOLD
struct data_t data = {};
data.pid = pid >> 32; // only process id
data.timestamp = tempp->timestamp;
...
...
@@ -164,13 +167,16 @@ int query_end(struct pt_regs *ctx) {
"""
.
replace
(
"DEFINE_USDT"
,
"#define USDT"
if
mode
==
"USDT"
else
""
)
\
.
replace
(
"DEFINE_MYSQL56"
,
"#define MYSQL56"
if
mode
==
"MYSQL56"
else
""
)
\
.
replace
(
"DEFINE_MYSQL57"
,
"#define MYSQL57"
if
mode
==
"MYSQL57"
else
""
)
\
.
replace
(
"DEFINE_THRESHOLD"
,
(
"#define THRESHOLD "
+
str
(
threshold_ns
))
if
threshold_ns
>
0
else
""
)
.
replace
(
"DEFINE_THRESHOLD"
,
"#define THRESHOLD %d"
%
threshold_ns
if
threshold_ns
>
0
else
""
)
if
mode
.
startswith
(
"MYSQL"
):
# Uprobes mode
bpf
=
BPF
(
text
=
program
)
bpf
.
attach_uprobe
(
name
=
args
.
path
,
sym
=
mysql_func_name
,
fn_name
=
"query_start"
)
bpf
.
attach_uretprobe
(
name
=
args
.
path
,
sym
=
mysql_func_name
,
fn_name
=
"query_end"
)
bpf
.
attach_uprobe
(
name
=
args
.
path
,
sym
=
mysql_func_name
,
fn_name
=
"query_start"
)
bpf
.
attach_uretprobe
(
name
=
args
.
path
,
sym
=
mysql_func_name
,
fn_name
=
"query_end"
)
else
:
# USDT mode
if
not
args
.
pids
or
len
(
args
.
pids
)
==
0
:
...
...
tools/lib/ucalls.py
View file @
ee433d4e
...
...
@@ -67,7 +67,8 @@ if language == "java":
return_probe
=
"method__return"
read_class
=
"bpf_usdt_readarg(2, ctx, &clazz);"
read_method
=
"bpf_usdt_readarg(4, ctx, &method);"
extra_message
=
"If you do not see any results, make sure you ran java with option -XX:+ExtendedDTraceProbes"
extra_message
=
(
"If you do not see any results, make sure you ran java"
" with option -XX:+ExtendedDTraceProbes"
)
elif
language
==
"python"
:
entry_probe
=
"function__entry"
return_probe
=
"function__return"
...
...
@@ -84,7 +85,8 @@ elif language == "php":
return_probe
=
"function__return"
read_class
=
"bpf_usdt_readarg(4, ctx, &clazz);"
read_method
=
"bpf_usdt_readarg(1, ctx, &method);"
extra_message
=
"If you do not see any results, make sure the environment variable USE_ZEND_DTRACE is set to 1"
extra_message
=
(
"If you do not see any results, make sure the environment"
" variable USE_ZEND_DTRACE is set to 1"
)
elif
not
language
or
language
==
"none"
:
if
not
args
.
syscalls
:
print
(
"Nothing to do; use -S to trace syscalls."
)
...
...
tools/memleak.py
View file @
ee433d4e
...
...
@@ -282,7 +282,7 @@ int posix_memalign_exit(struct pt_regs *ctx) {
memptrs.delete(&pid);
if (bpf_probe_read(&addr, sizeof(void*), (void*)(size_t)*memptr64)
!= 0
)
if (bpf_probe_read(&addr, sizeof(void*), (void*)(size_t)*memptr64))
return 0;
u64 addr64 = (u64)(size_t)addr;
...
...
@@ -384,7 +384,7 @@ if not kernel_trace:
stack_flags
+=
"|BPF_F_USER_STACK"
bpf_source
=
bpf_source
.
replace
(
"STACK_FLAGS"
,
stack_flags
)
bpf
_program
=
BPF
(
text
=
bpf_source
)
bpf
=
BPF
(
text
=
bpf_source
)
if
not
kernel_trace
:
print
(
"Attaching to pid %d, Ctrl+C to quit."
%
pid
)
...
...
@@ -394,12 +394,12 @@ if not kernel_trace:
fn_prefix
=
sym
try
:
bpf
_program
.
attach_uprobe
(
name
=
obj
,
sym
=
sym
,
fn_name
=
fn_prefix
+
"_enter"
,
pid
=
pid
)
bpf
_program
.
attach_uretprobe
(
name
=
obj
,
sym
=
sym
,
fn_name
=
fn_prefix
+
"_exit"
,
pid
=
pid
)
bpf
.
attach_uprobe
(
name
=
obj
,
sym
=
sym
,
fn_name
=
fn_prefix
+
"_enter"
,
pid
=
pid
)
bpf
.
attach_uretprobe
(
name
=
obj
,
sym
=
sym
,
fn_name
=
fn_prefix
+
"_exit"
,
pid
=
pid
)
except
Exception
:
if
can_fail
:
return
...
...
@@ -413,8 +413,8 @@ if not kernel_trace:
attach_probes
(
"valloc"
)
attach_probes
(
"memalign"
)
attach_probes
(
"pvalloc"
)
attach_probes
(
"aligned_alloc"
,
can_fail
=
True
)
# added in C11
bpf
_program
.
attach_uprobe
(
name
=
obj
,
sym
=
"free"
,
fn_name
=
"free_enter"
,
attach_probes
(
"aligned_alloc"
,
can_fail
=
True
)
# added in C11
bpf
.
attach_uprobe
(
name
=
obj
,
sym
=
"free"
,
fn_name
=
"free_enter"
,
pid
=
pid
)
else
:
...
...
@@ -425,11 +425,12 @@ else:
#
# Memory allocations in Linux kernel are not limited to malloc/free
# equivalents. It's also common to allocate a memory page or multiple
# pages. Page allocator have two interfaces, one working with page frame
# numbers (PFN), while other working with page addresses. It's possible
# to allocate pages with one kind of functions, and free them with
# another. Code in kernel can easy convert PFNs to addresses and back,
# but it's hard to do the same in eBPF kprobe without fragile hacks.
# pages. Page allocator have two interfaces, one working with page
# frame numbers (PFN), while other working with page addresses. It's
# possible to allocate pages with one kind of functions, and free them
# with another. Code in kernel can easy convert PFNs to addresses and
# back, but it's hard to do the same in eBPF kprobe without fragile
# hacks.
#
# Fortunately, Linux exposes tracepoints for memory allocations, which
# can be instrumented by eBPF programs. Tracepoint for page allocations
...
...
@@ -440,8 +441,8 @@ def print_outstanding():
print
(
"[%s] Top %d stacks with outstanding allocations:"
%
(
datetime
.
now
().
strftime
(
"%H:%M:%S"
),
top_stacks
))
alloc_info
=
{}
allocs
=
bpf
_program
[
"allocs"
]
stack_traces
=
bpf
_program
[
"stack_traces"
]
allocs
=
bpf
[
"allocs"
]
stack_traces
=
bpf
[
"stack_traces"
]
for
address
,
info
in
sorted
(
allocs
.
items
(),
key
=
lambda
a
:
a
[
1
].
size
):
if
BPF
.
monotonic_time
()
-
min_age_ns
<
info
.
timestamp_ns
:
continue
...
...
@@ -453,7 +454,7 @@ def print_outstanding():
stack
=
list
(
stack_traces
.
walk
(
info
.
stack_id
))
combined
=
[]
for
addr
in
stack
:
combined
.
append
(
bpf
_program
.
sym
(
addr
,
pid
,
combined
.
append
(
bpf
.
sym
(
addr
,
pid
,
show_module
=
True
,
show_offset
=
True
))
alloc_info
[
info
.
stack_id
]
=
Allocation
(
combined
,
info
.
size
)
...
...
@@ -467,8 +468,8 @@ def print_outstanding():
(
alloc
.
size
,
alloc
.
count
,
"
\
n
\
t
\
t
"
.
join
(
alloc
.
stack
)))
def
print_outstanding_combined
():
stack_traces
=
bpf
_program
[
"stack_traces"
]
stacks
=
sorted
(
bpf
_program
[
"combined_allocs"
].
items
(),
stack_traces
=
bpf
[
"stack_traces"
]
stacks
=
sorted
(
bpf
[
"combined_allocs"
].
items
(),
key
=
lambda
a
:
-
a
[
1
].
total_size
)
cnt
=
1
entries
=
[]
...
...
@@ -476,7 +477,7 @@ def print_outstanding_combined():
try
:
trace
=
[]
for
addr
in
stack_traces
.
walk
(
stack_id
.
value
):
sym
=
bpf
_program
.
sym
(
addr
,
pid
,
sym
=
bpf
.
sym
(
addr
,
pid
,
show_module
=
True
,
show_offset
=
True
)
trace
.
append
(
sym
)
...
...
@@ -500,7 +501,7 @@ def print_outstanding_combined():
count_so_far
=
0
while
True
:
if
trace_all
:
print
(
bpf
_program
.
trace_fields
())
print
(
bpf
.
trace_fields
())
else
:
try
:
sleep
(
interval
)
...
...
tools/nfsslower.py
View file @
ee433d4e
...
...
@@ -318,7 +318,7 @@ else:
"OFF_KB"
,
"LAT(ms)"
,
"FILENAME"
))
b
[
"events"
].
open_perf_buffer
(
print_event
,
page_cnt
=
64
)
while
1
:
b
.
kprobe_poll
()
tools/sslsniff.py
View file @
ee433d4e
...
...
@@ -199,13 +199,9 @@ def print_event(cpu, data, size, rw):
e_mark
=
"-"
*
5
+
" END DATA (TRUNCATED, "
+
str
(
truncated_bytes
)
+
\
" bytes lost) "
+
"-"
*
5
print
(
"%-12s %-18.9f %-16s %-6d %-6d
\
n
%s
\
n
%s
\
n
%s
\
n
\
n
"
%
(
rw
,
time_s
,
event
.
comm
.
decode
(),
event
.
pid
,
event
.
len
,
s_mark
,
event
.
v0
.
decode
(),
e_mark
))
fmt
=
"%-12s %-18.9f %-16s %-6d %-6d
\
n
%s
\
n
%s
\
n
%s
\
n
\
n
"
print
(
fmt
%
(
rw
,
time_s
,
event
.
comm
.
decode
(),
event
.
pid
,
event
.
len
,
s_mark
,
event
.
v0
.
decode
(),
e_mark
))
b
[
"perf_SSL_write"
].
open_perf_buffer
(
print_event_write
)
b
[
"perf_SSL_read"
].
open_perf_buffer
(
print_event_read
)
...
...
tools/tcptop.py
View file @
ee433d4e
...
...
@@ -149,7 +149,7 @@ int kprobe__tcp_cleanup_rbuf(struct pt_regs *ctx, struct sock *sk, int copied)
u64 *val, zero = 0;
if (copied <= 0)
return 0;
return 0;
if (family == AF_INET) {
struct ipv4_key_t ipv4_key = {.pid = pid};
...
...
tools/tcptracer.py
View file @
ee433d4e
...
...
@@ -546,7 +546,7 @@ def print_ipv4_event(cpu, data, size):
if
args
.
verbose
:
print
(
"%-14d"
%
(
event
.
ts_ns
-
start_ts
),
end
=
""
)
else
:
print
(
"%-9.3f"
%
((
float
(
event
.
ts_ns
)
-
start_ts
)
/
100000000
0
),
end
=
""
)
print
(
"%-9.3f"
%
((
event
.
ts_ns
-
start_ts
)
/
1000000000.
0
),
end
=
""
)
if
event
.
type
==
1
:
type_str
=
"C"
elif
event
.
type
==
2
:
...
...
@@ -583,7 +583,7 @@ def print_ipv6_event(cpu, data, size):
if
args
.
verbose
:
print
(
"%-14d"
%
(
event
.
ts_ns
-
start_ts
),
end
=
""
)
else
:
print
(
"%-9.3f"
%
((
float
(
event
.
ts_ns
)
-
start_ts
)
/
100000000
0
),
end
=
""
)
print
(
"%-9.3f"
%
((
event
.
ts_ns
-
start_ts
)
/
1000000000.
0
),
end
=
""
)
if
event
.
type
==
1
:
type_str
=
"C"
elif
event
.
type
==
2
:
...
...
@@ -601,8 +601,8 @@ def print_ipv6_event(cpu, data, size):
print
(
"%-6d %-16s %-2d %-16s %-16s %-6d %-6d"
%
(
event
.
pid
,
event
.
comm
.
decode
(
'utf-8'
),
event
.
ip
,
"["
+
inet_ntop
(
AF_INET6
,
event
.
saddr
)
+
"]"
,
"["
+
inet_ntop
(
AF_INET6
,
event
.
daddr
)
+
"]"
,
"["
+
inet_ntop
(
AF_INET6
,
event
.
saddr
)
+
"]"
,
"["
+
inet_ntop
(
AF_INET6
,
event
.
daddr
)
+
"]"
,
event
.
sport
,
event
.
dport
),
end
=
""
)
if
args
.
verbose
and
not
args
.
netns
:
...
...
tools/trace.py
View file @
ee433d4e
...
...
@@ -492,8 +492,8 @@ BPF_PERF_OUTPUT(%s);
time
=
strftime
(
"%H:%M:%S"
)
if
Probe
.
use_localtime
else
\
Probe
.
_time_off_str
(
event
.
timestamp_ns
)
print
(
"%-8s %-6d %-6d %-12s %-16s %s"
%
(
time
[:
8
],
event
.
tgid
,
event
.
pid
,
event
.
comm
.
decode
(),
self
.
_display_function
(),
msg
))
(
time
[:
8
],
event
.
tgid
,
event
.
pid
,
event
.
comm
.
decode
(),
self
.
_display_function
(),
msg
))
if
self
.
kernel_stack
:
self
.
print_stack
(
bpf
,
event
.
kernel_stack_id
,
-
1
)
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment