add loads tool

README.md

@@ -149,6 +149,7 @@ bpftrace contains various tools, which also serve as examples of programming in
 - tools/[capable.bt](tools/capable.bt): Trace security capabilitiy checks. [Examples](tools/capable_example.txt).
 - tools/[cpuwalk.bt](tools/cpuwalk.bt): Sample which CPUs are executing processes. [Examples](tools/cpuwalk_example.txt).
 - tools/[gethostlatency.bt](tools/gethostlatency.bt): Show latency for getaddrinfo/gethostbyname[2] calls. [Examples](tools/gethostlatency_example.txt).
+- tools/[loads.bt](tools/loads.bt): Print load averages. [Examples](tools/loads_example.txt).
 - tools/[pidpersec.bt](tools/pidpersec.bt): Count new procesess (via fork). [Examples](tools/pidpersec_example.txt).
 - tools/[vfscount.bt](tools/vfscount.bt): Count VFS calls. [Examples](tools/vfscount_example.txt).
 - tools/[vfsstat.bt](tools/vfsstat.bt): Count some VFS calls, with per-second summaries. [Examples](tools/vfsstat_example.txt).

man/man8/loads.8

+.TH loads 8  "2018-09-10" "USER COMMANDS"
+.SH NAME
+loads.bt \- Prints load averages. Uses bpftrace/eBPF.
+.SH SYNOPSIS
+.B loads.bt
+.SH DESCRIPTION
+These are the same load averages printed by "uptime", but to three decimal
+places instead of two (not that it really matters). This is really a
+demonstration of fetching and processing a kernel structure from bpftrace.
+
+Since this uses BPF, only the root user can use this tool.
+.SH REQUIREMENTS
+CONFIG_BPF and bpftrace.
+.SH EXAMPLES
+.TP
+Print system load averages every second:
+#
+.B loads
+.SH FIELDS
+.TP
+HH:MM:SS
+Each output line includes time of printing in "HH:MM:SS" format.
+.TP
+load averages:
+These are exponentially-damped moving sum averages of the system loads. 
+Load is a measurement of demand on system resources, which include CPUs and
+other resources that are accessed with the kernel in an uninterruptible state
+(TASK_UNINTERRUPTIBLE), which includes types of disk I/O and lock accessses.
+Linux load averages originally reflected CPU demand only, as it does in other
+OSes, but this was changed in Linux 0.99.14. This demand meseasurement reflects
+not just the utilized resource, but also the queued demand (a saturation
+measurement). Finally, the three numbers are called the "one-", "five-", and
+"fifteen-minute" load averages, however these times are constants used in the
+exponentially-damping equation, and the load averages reflect load beyond these
+times. Were you expecting an accurate description of load averages in
+the man page of a bpftrace tool?
+.SH OVERHEAD
+Other than bpftrace startup time, negligible.
+.SH SOURCE
+This is from bpftrace.
+.IP
+https://github.com/iovisor/bpftrace
+.PP
+Also look in the bpftrace distribution for a companion _examples.txt file containing
+example usage, output, and commentary for this tool.
+.SH REFERENCE
+For more on load averages, see:
+.PP
+http://www.brendangregg.com/blog/2017-08-08/linux-load-averages.html
+.SH OS
+Linux
+.SH STABILITY
+Unstable - in development.
+.SH AUTHOR
+Brendan Gregg
+.SH SEE ALSO
+uptime(1)

tools/bashreadline.bt

 /*
- * bashreadline	Print entered bash commands from all running shells.
- *		For Linux, uses bpftrace and eBPF.
+ * bashreadline    Print entered bash commands from all running shells.
+ *                 For Linux, uses bpftrace and eBPF.
  *
  * This works by tracing the readline() function using a uretprobe (uprobes).
  *

tools/loads.bt

+/*
+ * loads	Prints load averages.
+ *		For Linux, uses bpftrace and eBPF.
+ *
+ * These are the same load averages printed by "uptime", but to three decimal
+ * places instead of two (not that it really matters). This is really a
+ * demonstration of fetching and processing a kernel structure from bpftrace.
+ *
+ * USAGE: loads.bt
+ *
+ * This is a bpftrace version of a DTraceToolkit tool.
+ *
+ * Copyright 2018 Netflix, Inc.
+ * Licensed under the Apache License, Version 2.0 (the "License")
+ *
+ * 10-Sep-2018	Brendan Gregg	Created this.
+ */
+
+BEGIN
+{
+	printf("Reading load averages... Hit Ctrl-C to end.\n");
+
+}
+
+interval:s:1
+{
+	/*
+	 * See fs/proc/loadavg.c and include/linux/sched/loadavg.h for the
+	 * following calculations.
+	 */
+	$avenrun = kaddr("avenrun");
+	$load1 = *$avenrun;
+	$load5 = *($avenrun + 8);
+	$load15 = *($avenrun + 16);
+	time("%H:%M:%S ");
+	printf("load averages: %d.%03d %d.%03d %d.%03d\n",
+	    ($load1 / 2048), (($load1 & 2047) * 1000) / 2048,
+	    ($load5 / 2048), (($load5 & 2047) * 1000) / 2048,
+	    ($load15 / 2048), (($load15 & 2047) * 1000) / 2048
+	);
+}

tools/loads_example.txt

+Demonstrations of loads, the Linux bpftrace/eBPF version.
+
+
+This is a simple tool that prints the system load averages, to three decimal
+places each (not that it really matters), as a demonstration of fetching
+kernel structures from bpftrace:
+
+# bpftrace loads.bt
+Attaching 2 probes...
+Reading load averages... Hit Ctrl-C to end.
+21:29:17 load averages: 2.091 2.048 1.947
+21:29:18 load averages: 2.091 2.048 1.947
+21:29:19 load averages: 2.091 2.048 1.947
+21:29:20 load averages: 2.091 2.048 1.947
+21:29:21 load averages: 2.164 2.064 1.953
+21:29:22 load averages: 2.164 2.064 1.953
+21:29:23 load averages: 2.164 2.064 1.953
+^C
+
+These are the same load averages printed by uptime:
+
+# uptime
+ 21:29:24 up 2 days, 18:57,  3 users,  load average: 2.16, 2.06, 1.95
+
+
+For more on load averages, see my post:
+http://www.brendangregg.com/blog/2017-08-08/linux-load-averages.html