Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
B
bcc
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
0
Merge Requests
0
Analytics
Analytics
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Commits
Issue Boards
Open sidebar
Kirill Smelkov
bcc
Commits
ee433d4e
Commit
ee433d4e
authored
Oct 28, 2017
by
4ast
Committed by
GitHub
Oct 28, 2017
Browse files
Options
Browse Files
Download
Plain Diff
Merge pull request #1383 from pchaigno/pep8
Linter cleanups
parents
fab43ed9
ae0e0257
Changes
10
Show whitespace changes
Inline
Side-by-side
Showing
10 changed files
with
67 additions
and
58 deletions
+67
-58
tools/bashreadline.py
tools/bashreadline.py
+2
-1
tools/bpflist.py
tools/bpflist.py
+6
-3
tools/dbslower.py
tools/dbslower.py
+21
-15
tools/lib/ucalls.py
tools/lib/ucalls.py
+4
-2
tools/memleak.py
tools/memleak.py
+23
-22
tools/nfsslower.py
tools/nfsslower.py
+1
-1
tools/sslsniff.py
tools/sslsniff.py
+3
-7
tools/tcptop.py
tools/tcptop.py
+1
-1
tools/tcptracer.py
tools/tcptracer.py
+4
-4
tools/trace.py
tools/trace.py
+2
-2
No files found.
tools/bashreadline.py
View file @
ee433d4e
...
...
@@ -56,7 +56,8 @@ print("%-9s %-6s %s" % ("TIME", "PID", "COMMAND"))
def
print_event
(
cpu
,
data
,
size
):
event
=
ct
.
cast
(
data
,
ct
.
POINTER
(
Data
)).
contents
print
(
"%-9s %-6d %s"
%
(
strftime
(
"%H:%M:%S"
),
event
.
pid
,
event
.
str
.
decode
()))
print
(
"%-9s %-6d %s"
%
(
strftime
(
"%H:%M:%S"
),
event
.
pid
,
event
.
str
.
decode
()))
b
[
"events"
].
open_perf_buffer
(
print_event
)
while
1
:
...
...
tools/bpflist.py
View file @
ee433d4e
...
...
@@ -40,7 +40,8 @@ def comm_for_pid(pid):
counts
=
{}
def
parse_probes
(
typ
):
if
args
.
verbosity
>
1
:
print
(
"open %ss:"
%
typ
)
if
args
.
verbosity
>
1
:
print
(
"open %ss:"
%
typ
)
for
probe
in
open
(
"/sys/kernel/debug/tracing/%s_events"
%
typ
):
# Probes opened by bcc have a specific pattern that includes the pid
# of the requesting process.
...
...
@@ -48,8 +49,10 @@ def parse_probes(typ):
if
match
:
pid
=
int
(
match
.
group
(
1
))
counts
[(
pid
,
typ
)]
=
counts
.
get
((
pid
,
typ
),
0
)
+
1
if
args
.
verbosity
>
1
:
print
(
probe
.
strip
())
if
args
.
verbosity
>
1
:
print
(
""
)
if
args
.
verbosity
>
1
:
print
(
probe
.
strip
())
if
args
.
verbosity
>
1
:
print
(
""
)
if
args
.
verbosity
>
0
:
parse_probes
(
"kprobe"
)
...
...
tools/dbslower.py
View file @
ee433d4e
...
...
@@ -2,7 +2,8 @@
#
# dbslower Trace MySQL and PostgreSQL queries slower than a threshold.
#
# USAGE: dbslower [-v] [-p PID [PID ...]] [-b PATH_TO_BINARY] [-m THRESHOLD] {mysql,postgres}
# USAGE: dbslower [-v] [-p PID [PID ...]] [-b PATH_TO_BINARY] [-m THRESHOLD]
# {mysql,postgres}
#
# By default, a threshold of 1ms is used. Set the threshold to 0 to trace all
# queries (verbose).
...
...
@@ -57,7 +58,8 @@ threshold_ns = args.threshold * 1000000
mode
=
"USDT"
if
args
.
path
and
not
args
.
pids
:
if
args
.
db
==
"mysql"
:
symbols
=
BPF
.
get_user_functions_and_addresses
(
args
.
path
,
"
\
\
w+dispatch_command
\
\
w+"
)
regex
=
"
\
\
w+dispatch_command
\
\
w+"
symbols
=
BPF
.
get_user_functions_and_addresses
(
args
.
path
,
regex
)
if
len
(
symbols
)
==
0
:
print
(
"Can't find function 'dispatch_command' in %s"
%
(
args
.
path
))
...
...
@@ -71,7 +73,8 @@ if args.path and not args.pids:
mode
=
"MYSQL56"
else
:
# Placeholder for PostrgeSQL
# Look on functions initStringInfo, pgstat_report_activity, EndCommand, NullCommand
# Look on functions initStringInfo, pgstat_report_activity, EndCommand,
# NullCommand
print
(
"Sorry at the moment PostgreSQL supports only USDT"
)
exit
(
1
)
...
...
@@ -164,13 +167,16 @@ int query_end(struct pt_regs *ctx) {
"""
.
replace
(
"DEFINE_USDT"
,
"#define USDT"
if
mode
==
"USDT"
else
""
)
\
.
replace
(
"DEFINE_MYSQL56"
,
"#define MYSQL56"
if
mode
==
"MYSQL56"
else
""
)
\
.
replace
(
"DEFINE_MYSQL57"
,
"#define MYSQL57"
if
mode
==
"MYSQL57"
else
""
)
\
.
replace
(
"DEFINE_THRESHOLD"
,
(
"#define THRESHOLD "
+
str
(
threshold_ns
))
if
threshold_ns
>
0
else
""
)
.
replace
(
"DEFINE_THRESHOLD"
,
"#define THRESHOLD %d"
%
threshold_ns
if
threshold_ns
>
0
else
""
)
if
mode
.
startswith
(
"MYSQL"
):
# Uprobes mode
bpf
=
BPF
(
text
=
program
)
bpf
.
attach_uprobe
(
name
=
args
.
path
,
sym
=
mysql_func_name
,
fn_name
=
"query_start"
)
bpf
.
attach_uretprobe
(
name
=
args
.
path
,
sym
=
mysql_func_name
,
fn_name
=
"query_end"
)
bpf
.
attach_uprobe
(
name
=
args
.
path
,
sym
=
mysql_func_name
,
fn_name
=
"query_start"
)
bpf
.
attach_uretprobe
(
name
=
args
.
path
,
sym
=
mysql_func_name
,
fn_name
=
"query_end"
)
else
:
# USDT mode
if
not
args
.
pids
or
len
(
args
.
pids
)
==
0
:
...
...
tools/lib/ucalls.py
View file @
ee433d4e
...
...
@@ -67,7 +67,8 @@ if language == "java":
return_probe
=
"method__return"
read_class
=
"bpf_usdt_readarg(2, ctx, &clazz);"
read_method
=
"bpf_usdt_readarg(4, ctx, &method);"
extra_message
=
"If you do not see any results, make sure you ran java with option -XX:+ExtendedDTraceProbes"
extra_message
=
(
"If you do not see any results, make sure you ran java"
" with option -XX:+ExtendedDTraceProbes"
)
elif
language
==
"python"
:
entry_probe
=
"function__entry"
return_probe
=
"function__return"
...
...
@@ -84,7 +85,8 @@ elif language == "php":
return_probe
=
"function__return"
read_class
=
"bpf_usdt_readarg(4, ctx, &clazz);"
read_method
=
"bpf_usdt_readarg(1, ctx, &method);"
extra_message
=
"If you do not see any results, make sure the environment variable USE_ZEND_DTRACE is set to 1"
extra_message
=
(
"If you do not see any results, make sure the environment"
" variable USE_ZEND_DTRACE is set to 1"
)
elif
not
language
or
language
==
"none"
:
if
not
args
.
syscalls
:
print
(
"Nothing to do; use -S to trace syscalls."
)
...
...
tools/memleak.py
View file @
ee433d4e
...
...
@@ -282,7 +282,7 @@ int posix_memalign_exit(struct pt_regs *ctx) {
memptrs.delete(&pid);
if (bpf_probe_read(&addr, sizeof(void*), (void*)(size_t)*memptr64)
!= 0
)
if (bpf_probe_read(&addr, sizeof(void*), (void*)(size_t)*memptr64))
return 0;
u64 addr64 = (u64)(size_t)addr;
...
...
@@ -384,7 +384,7 @@ if not kernel_trace:
stack_flags
+=
"|BPF_F_USER_STACK"
bpf_source
=
bpf_source
.
replace
(
"STACK_FLAGS"
,
stack_flags
)
bpf
_program
=
BPF
(
text
=
bpf_source
)
bpf
=
BPF
(
text
=
bpf_source
)
if
not
kernel_trace
:
print
(
"Attaching to pid %d, Ctrl+C to quit."
%
pid
)
...
...
@@ -394,11 +394,11 @@ if not kernel_trace:
fn_prefix
=
sym
try
:
bpf
_program
.
attach_uprobe
(
name
=
obj
,
sym
=
sym
,
fn_name
=
fn_prefix
+
"_enter"
,
bpf
.
attach_uprobe
(
name
=
obj
,
sym
=
sym
,
fn_name
=
fn_prefix
+
"_enter"
,
pid
=
pid
)
bpf
_program
.
attach_uretprobe
(
name
=
obj
,
sym
=
sym
,
fn_name
=
fn_prefix
+
"_exit"
,
bpf
.
attach_uretprobe
(
name
=
obj
,
sym
=
sym
,
fn_name
=
fn_prefix
+
"_exit"
,
pid
=
pid
)
except
Exception
:
if
can_fail
:
...
...
@@ -414,7 +414,7 @@ if not kernel_trace:
attach_probes
(
"memalign"
)
attach_probes
(
"pvalloc"
)
attach_probes
(
"aligned_alloc"
,
can_fail
=
True
)
# added in C11
bpf
_program
.
attach_uprobe
(
name
=
obj
,
sym
=
"free"
,
fn_name
=
"free_enter"
,
bpf
.
attach_uprobe
(
name
=
obj
,
sym
=
"free"
,
fn_name
=
"free_enter"
,
pid
=
pid
)
else
:
...
...
@@ -425,11 +425,12 @@ else:
#
# Memory allocations in Linux kernel are not limited to malloc/free
# equivalents. It's also common to allocate a memory page or multiple
# pages. Page allocator have two interfaces, one working with page frame
# numbers (PFN), while other working with page addresses. It's possible
# to allocate pages with one kind of functions, and free them with
# another. Code in kernel can easy convert PFNs to addresses and back,
# but it's hard to do the same in eBPF kprobe without fragile hacks.
# pages. Page allocator have two interfaces, one working with page
# frame numbers (PFN), while other working with page addresses. It's
# possible to allocate pages with one kind of functions, and free them
# with another. Code in kernel can easy convert PFNs to addresses and
# back, but it's hard to do the same in eBPF kprobe without fragile
# hacks.
#
# Fortunately, Linux exposes tracepoints for memory allocations, which
# can be instrumented by eBPF programs. Tracepoint for page allocations
...
...
@@ -440,8 +441,8 @@ def print_outstanding():
print
(
"[%s] Top %d stacks with outstanding allocations:"
%
(
datetime
.
now
().
strftime
(
"%H:%M:%S"
),
top_stacks
))
alloc_info
=
{}
allocs
=
bpf
_program
[
"allocs"
]
stack_traces
=
bpf
_program
[
"stack_traces"
]
allocs
=
bpf
[
"allocs"
]
stack_traces
=
bpf
[
"stack_traces"
]
for
address
,
info
in
sorted
(
allocs
.
items
(),
key
=
lambda
a
:
a
[
1
].
size
):
if
BPF
.
monotonic_time
()
-
min_age_ns
<
info
.
timestamp_ns
:
continue
...
...
@@ -453,7 +454,7 @@ def print_outstanding():
stack
=
list
(
stack_traces
.
walk
(
info
.
stack_id
))
combined
=
[]
for
addr
in
stack
:
combined
.
append
(
bpf
_program
.
sym
(
addr
,
pid
,
combined
.
append
(
bpf
.
sym
(
addr
,
pid
,
show_module
=
True
,
show_offset
=
True
))
alloc_info
[
info
.
stack_id
]
=
Allocation
(
combined
,
info
.
size
)
...
...
@@ -467,8 +468,8 @@ def print_outstanding():
(
alloc
.
size
,
alloc
.
count
,
"
\
n
\
t
\
t
"
.
join
(
alloc
.
stack
)))
def
print_outstanding_combined
():
stack_traces
=
bpf
_program
[
"stack_traces"
]
stacks
=
sorted
(
bpf
_program
[
"combined_allocs"
].
items
(),
stack_traces
=
bpf
[
"stack_traces"
]
stacks
=
sorted
(
bpf
[
"combined_allocs"
].
items
(),
key
=
lambda
a
:
-
a
[
1
].
total_size
)
cnt
=
1
entries
=
[]
...
...
@@ -476,7 +477,7 @@ def print_outstanding_combined():
try
:
trace
=
[]
for
addr
in
stack_traces
.
walk
(
stack_id
.
value
):
sym
=
bpf
_program
.
sym
(
addr
,
pid
,
sym
=
bpf
.
sym
(
addr
,
pid
,
show_module
=
True
,
show_offset
=
True
)
trace
.
append
(
sym
)
...
...
@@ -500,7 +501,7 @@ def print_outstanding_combined():
count_so_far
=
0
while
True
:
if
trace_all
:
print
(
bpf
_program
.
trace_fields
())
print
(
bpf
.
trace_fields
())
else
:
try
:
sleep
(
interval
)
...
...
tools/nfsslower.py
View file @
ee433d4e
tools/sslsniff.py
View file @
ee433d4e
...
...
@@ -199,13 +199,9 @@ def print_event(cpu, data, size, rw):
e_mark
=
"-"
*
5
+
" END DATA (TRUNCATED, "
+
str
(
truncated_bytes
)
+
\
" bytes lost) "
+
"-"
*
5
print
(
"%-12s %-18.9f %-16s %-6d %-6d
\
n
%s
\
n
%s
\
n
%s
\
n
\
n
"
%
(
rw
,
time_s
,
event
.
comm
.
decode
(),
event
.
pid
,
event
.
len
,
s_mark
,
event
.
v0
.
decode
(),
e_mark
))
fmt
=
"%-12s %-18.9f %-16s %-6d %-6d
\
n
%s
\
n
%s
\
n
%s
\
n
\
n
"
print
(
fmt
%
(
rw
,
time_s
,
event
.
comm
.
decode
(),
event
.
pid
,
event
.
len
,
s_mark
,
event
.
v0
.
decode
(),
e_mark
))
b
[
"perf_SSL_write"
].
open_perf_buffer
(
print_event_write
)
b
[
"perf_SSL_read"
].
open_perf_buffer
(
print_event_read
)
...
...
tools/tcptop.py
View file @
ee433d4e
tools/tcptracer.py
View file @
ee433d4e
...
...
@@ -546,7 +546,7 @@ def print_ipv4_event(cpu, data, size):
if
args
.
verbose
:
print
(
"%-14d"
%
(
event
.
ts_ns
-
start_ts
),
end
=
""
)
else
:
print
(
"%-9.3f"
%
((
float
(
event
.
ts_ns
)
-
start_ts
)
/
100000000
0
),
end
=
""
)
print
(
"%-9.3f"
%
((
event
.
ts_ns
-
start_ts
)
/
1000000000.
0
),
end
=
""
)
if
event
.
type
==
1
:
type_str
=
"C"
elif
event
.
type
==
2
:
...
...
@@ -583,7 +583,7 @@ def print_ipv6_event(cpu, data, size):
if
args
.
verbose
:
print
(
"%-14d"
%
(
event
.
ts_ns
-
start_ts
),
end
=
""
)
else
:
print
(
"%-9.3f"
%
((
float
(
event
.
ts_ns
)
-
start_ts
)
/
100000000
0
),
end
=
""
)
print
(
"%-9.3f"
%
((
event
.
ts_ns
-
start_ts
)
/
1000000000.
0
),
end
=
""
)
if
event
.
type
==
1
:
type_str
=
"C"
elif
event
.
type
==
2
:
...
...
@@ -601,8 +601,8 @@ def print_ipv6_event(cpu, data, size):
print
(
"%-6d %-16s %-2d %-16s %-16s %-6d %-6d"
%
(
event
.
pid
,
event
.
comm
.
decode
(
'utf-8'
),
event
.
ip
,
"["
+
inet_ntop
(
AF_INET6
,
event
.
saddr
)
+
"]"
,
"["
+
inet_ntop
(
AF_INET6
,
event
.
daddr
)
+
"]"
,
"["
+
inet_ntop
(
AF_INET6
,
event
.
saddr
)
+
"]"
,
"["
+
inet_ntop
(
AF_INET6
,
event
.
daddr
)
+
"]"
,
event
.
sport
,
event
.
dport
),
end
=
""
)
if
args
.
verbose
and
not
args
.
netns
:
...
...
tools/trace.py
View file @
ee433d4e
...
...
@@ -492,8 +492,8 @@ BPF_PERF_OUTPUT(%s);
time
=
strftime
(
"%H:%M:%S"
)
if
Probe
.
use_localtime
else
\
Probe
.
_time_off_str
(
event
.
timestamp_ns
)
print
(
"%-8s %-6d %-6d %-12s %-16s %s"
%
(
time
[:
8
],
event
.
tgid
,
event
.
pid
,
event
.
comm
.
decode
(),
self
.
_display_function
(),
msg
))
(
time
[:
8
],
event
.
tgid
,
event
.
pid
,
event
.
comm
.
decode
(),
self
.
_display_function
(),
msg
))
if
self
.
kernel_stack
:
self
.
print_stack
(
bpf
,
event
.
kernel_stack_id
,
-
1
)
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment