add vfsstat tool

README.md

@@ -151,6 +151,7 @@ bpftrace contains various tools, which also serve as examples of programming in
 - tools/[gethostlatency.bt](tools/gethostlatency.bt): Show latency for getaddrinfo/gethostbyname[2] calls. [Examples](tools/gethostlatency_example.txt).
 - tools/[pidpersec.bt](tools/pidpersec.bt): Count new procesess (via fork). [Examples](tools/pidpersec_example.txt).
 - tools/[vfscount.bt](tools/vfscount.bt): Count VFS calls. [Examples](tools/vfscount_example.txt).
+- tools/[vfsstat.bt](tools/vfsstat.bt): Count some VFS calls, with per-second summaries. [Examples](tools/vfsstat_example.txt).
 
 For more eBPF observability tools, see [bcc tools](https://github.com/iovisor/bcc#tools).
 

man/man8/vfsstat.8

+.TH vfsstat 8  "2018-09-06" "USER COMMANDS"
+.SH NAME
+vfsstat.bt \- Count key VFS calls. Uses bpftrace/eBPF.
+.SH SYNOPSIS
+.B vfsstat.bt
+.SH DESCRIPTION
+This traces some common VFS calls and prints per-second summaries. This can
+be useful for general workload characterization, and looking for patterns
+in operation usage over time.
+
+This works by tracing some kernel vfs functions using dynamic tracing, and will
+need updating to match any changes to these functions. Edit the script to
+customize which functions are traced. Also see vfscount, which is more
+easily customized to trace multiple functions.
+
+Since this uses BPF, only the root user can use this tool.
+.SH REQUIREMENTS
+CONFIG_BPF and bpftrace.
+.SH EXAMPLES
+.TP
+Count some VFS calls, printing per-second summaries until Ctrl-C is hit:
+#
+.B vfsstat.bt
+.SH FIELDS
+.TP
+HH:MM:SS
+Each output summary is prefixed by the time of printing in "HH:MM:SS" format.
+.TP
+1st
+Kernel function name (in @[])
+.TP
+2nd
+Number of calls while tracing
+.SH OVERHEAD
+This traces various kernel vfs functions and maintains in-kernel counts, which
+are asynchronously copied to user-space. While the rate of VFS operations can
+be very high (>1M/sec), this is a relatively efficient way to trace these
+events, and so the overhead is expected to be small for normal workloads.
+Measure in a test environment.
+.SH SOURCE
+This is from bpftrace.
+.IP
+https://github.com/iovisor/bpftrace
+.PP
+Also look in the bpftrace distribution for a companion _examples.txt file
+containing example usage, output, and commentary for this tool.
+
+This is a bpftrace version of the bcc tool of the same name. The bcc tool
+may provide more options and customizations.
+.IP
+https://github.com/iovisor/bcc
+.SH OS
+Linux
+.SH STABILITY
+Unstable - in development.
+.SH AUTHOR
+Brendan Gregg
+.SH SEE ALSO
+vfscount.bt(8)

tools/vfsstat.bt

+/*
+ * vfsstat	Count some VFS calls, with per-second summaries.
+ *		For Linux, uses bpftrace and eBPF.
+ *
+ * Written as a basic example of counting multiple events and printing a
+ * per-second summary.
+ *
+ * USAGE: vfsstat.bt
+ *
+ * This is a bpftrace version of the bcc tool of the same name.
+ *
+ * Copyright 2018 Netflix, Inc.
+ * Licensed under the Apache License, Version 2.0 (the "License")
+ *
+ * 06-Sep-2018	Brendan Gregg	Created this.
+ */
+
+BEGIN
+{
+	printf("Tracing key VFS calls... Hit Ctrl-C to end.\n");
+
+}
+
+kprobe:vfs_read,
+kprobe:vfs_write,
+kprobe:vfs_fsync,
+kprobe:vfs_open,
+kprobe:vfs_create
+{
+	@[func] = count();
+}
+
+interval:s:1
+{
+	time();
+	print(@);
+	clear(@);
+}
+
+END
+{
+	clear(@);
+}

tools/vfsstat_example.txt

+Demonstrations of vfsstat, the Linux bpftrace/eBPF version.
+
+
+This traces some common VFS calls (see the script for the list) and prints
+per-second summaries.
+
+# bpftrace vfsstat.bt
+Attaching 8 probes...
+Tracing key VFS calls... Hit Ctrl-C to end.
+21:30:38
+@[vfs_write]: 1274
+@[vfs_open]: 8675
+@[vfs_read]: 11515
+
+21:30:39
+@[vfs_write]: 1155
+@[vfs_open]: 8077
+@[vfs_read]: 10398
+
+21:30:40
+@[vfs_write]: 1222
+@[vfs_open]: 8554
+@[vfs_read]: 11011
+
+21:30:41
+@[vfs_write]: 1230
+@[vfs_open]: 8605
+@[vfs_read]: 11077
+
+21:30:42
+@[vfs_write]: 1229
+@[vfs_open]: 8591
+@[vfs_read]: 11061
+
+^C
+
+Each second, a timestamp is printed ("HH:MM:SS") followed by common VFS
+functions and the number of calls for that second. While tracing, the vfs_read()
+kernel function was most frequent, occurring over 10,000 times per second.
+
+
+There is another version of this tool in bcc: https://github.com/iovisor/bcc
+The bcc version provides command line options.