add vfscount tool

README.md

@@ -150,6 +150,7 @@ bpftrace contains various tools, which also serve as examples of programming in
 - tools/[cpuwalk.bt](tools/cpuwalk.bt): Sample which CPUs are executing processes. [Examples](tools/cpuwalk_example.txt).
 - tools/[gethostlatency.bt](tools/gethostlatency.bt): Show latency for getaddrinfo/gethostbyname[2] calls. [Examples](tools/gethostlatency_example.txt).
 - tools/[pidpersec.bt](tools/pidpersec.bt): Count new procesess (via fork). [Examples](tools/pidpersec_example.txt).
+- tools/[vfscount.bt](tools/vfscount.bt): Count VFS calls. [Examples](tools/vfscount_example.txt).
 
 For more eBPF observability tools, see [bcc tools](https://github.com/iovisor/bcc#tools).
 

man/man8/vfscount.8

+.TH vfscount 8  "2018-09-06" "USER COMMANDS"
+.SH NAME
+vfscount.bt \- Count VFS calls ("vfs_*"). Uses bpftrace/eBPF.
+.SH SYNOPSIS
+.B vfscount.bt
+.SH DESCRIPTION
+This counts VFS calls. This can be useful for general workload
+characterization of these operations.
+
+This works by tracing all kernel functions beginning with "vfs_" using dynamic
+tracing. This may match more functions than you are interested in measuring:
+Edit the script to customize which functions to trace.
+
+Since this uses BPF, only the root user can use this tool.
+.SH REQUIREMENTS
+CONFIG_BPF and bpftrace.
+.SH EXAMPLES
+.TP
+Count all VFS calls until Ctrl-C is hit:
+#
+.B vfscount.bt
+.SH FIELDS
+.TP
+1st
+Kernel function name (in @[])
+.TP
+2nd
+Number of calls while tracing
+.SH OVERHEAD
+This traces kernel vfs functions and maintains in-kernel counts, which
+are asynchronously copied to user-space. While the rate of VFS operations can
+be very high (>1M/sec), this is a relatively efficient way to trace these
+events, and so the overhead is expected to be small for normal workloads.
+Measure in a test environment, and if overheads are an issue, edit the script
+to reduce the types of vfs functions traced (currently all beginning with
+"vfs_").
+.SH SOURCE
+This is from bpftrace.
+.IP
+https://github.com/iovisor/bpftrace
+.PP
+Also look in the bpftrace distribution for a companion _examples.txt file
+containing example usage, output, and commentary for this tool.
+
+This is a bpftrace version of the bcc tool of the same name. The bcc tool
+may provide more options and customizations.
+.IP
+https://github.com/iovisor/bcc
+.SH OS
+Linux
+.SH STABILITY
+Unstable - in development.
+.SH AUTHOR
+Brendan Gregg
+.SH SEE ALSO
+vfsstat.bt(8)

tools/vfscount.bt

+/*
+ * vfscount	Count VFS calls ("vfs_*").
+ *		For Linux, uses bpftrace and eBPF.
+ *
+ * Written as a basic example of counting kernel functions.
+ *
+ * USAGE: vfscount.bt
+ *
+ * This is a bpftrace version of the bcc tool of the same name.
+ *
+ * Copyright 2018 Netflix, Inc.
+ * Licensed under the Apache License, Version 2.0 (the "License")
+ *
+ * 06-Sep-2018	Brendan Gregg	Created this.
+ */
+
+BEGIN
+{
+	printf("Tracing VFS calls... Hit Ctrl-C to end.\n");
+
+}
+
+kprobe:vfs_*
+{
+	@[func] = count();
+}

tools/vfscount_example.txt

+Demonstrations of vfscount, the Linux bpftrace/eBPF version.
+
+
+Tracing all VFS calls:
+
+# bpftrace vfscount.bt
+Attaching 54 probes...
+cannot attach kprobe, Invalid argument
+Warning: could not attach probe kprobe:vfs_dedupe_get_page.isra.21, skipping.
+Tracing VFS calls... Hit Ctrl-C to end.
+^C
+
+@[vfs_fsync_range]: 4
+@[vfs_readlink]: 14
+@[vfs_statfs]: 56
+@[vfs_lock_file]: 60
+@[vfs_write]: 276
+@[vfs_statx]: 328
+@[vfs_statx_fd]: 394
+@[vfs_open]: 541
+@[vfs_getattr]: 595
+@[vfs_getattr_nosec]: 597
+@[vfs_read]: 1113
+
+While tracing, the vfs_read() call was the most frequent, occurring 1,113 times.
+
+VFS is the Virtual File System: a kernel abstraction for file systems and other
+resources that expose a file system interface. Much of VFS maps directly to the
+syscall interface. Tracing VFS calls gives you a high level breakdown of the
+kernel workload, and starting points for further investigation.
+
+Notet that a warning was printed: "Warning: could not attach probe
+kprobe:vfs_dedupe_get_page.isra.21": these are not currently instrumentable by
+bpftrace/kprobes, so a warning is printed to let you know that they will be
+missed.
+
+
+There is another version of this tool in bcc: https://github.com/iovisor/bcc