add gethostlatency tool

README.md

@@ -148,6 +148,7 @@ bpftrace contains various tools, which also serve as examples of programming in
 - tools/[bashreadline.bt](tools/bashreadline.bt): Print entered bash commands system wide. [Examples](tools/bashreadline_example.txt).
 - tools/[capable.bt](tools/capable.bt): Trace security capabilitiy checks. [Examples](tools/capable_example.txt).
 - tools/[cpuwalk.bt](tools/cpuwalk.bt): Sample which CPUs are executing processes. [Examples](tools/cpuwalk_example.txt).
+- tools/[gethostlatency.bt](tools/gethostlatency.bt): Show latency for getaddrinfo/gethostbyname[2] calls. [Examples](tools/gethostlatency_example.txt).
 
 For more eBPF observability tools, see [bcc tools](https://github.com/iovisor/bcc#tools).
 

man/man8/gethostlatency.8

+.TH gethostlatency 8  "2018-09-08" "USER COMMANDS"
+.SH NAME
+gethostlatency.bt \- Show latency for getaddrinfo/gethostbyname[2] calls. Uses bpftrace/eBPF.
+.SH SYNOPSIS
+.B gethostlatency.bt
+.SH DESCRIPTION
+This traces and prints when getaddrinfo(), gethostbyname(), and gethostbyname2()
+are called, system wide, and shows the responsible PID and command name,
+latency of the call (duration) in milliseconds, and the host string.
+
+This tool can be useful for identifying DNS latency, by identifying which
+remote host name lookups were slow, and by how much.
+
+This tool currently uses dynamic tracing of user-level functions and registers,
+and may need modifications to match your software and processor architecture.
+
+Since this uses BPF, only the root user can use this tool.
+.SH REQUIREMENTS
+CONFIG_BPF and bcc.
+.SH EXAMPLES
+.TP
+Trace host lookups (getaddrinfo/gethostbyname[2]) system wide:
+#
+.B gethostlatency.bt
+.SH FIELDS
+.TP
+TIME
+Time of the command (HH:MM:SS).
+.TP
+PID
+Process ID of the client performing the call.
+.TP
+COMM
+Process (command) name of the client performing the call.
+.TP
+LATms
+Latency of the call, in milliseconds.
+.TP
+HOST
+Host name string: the target of the lookup.
+.SH OVERHEAD
+The rate of lookups should be relatively low, so the overhead is not expected
+to be a problem.
+.SH SOURCE
+This is from bpftrace.
+.IP
+https://github.com/iovisor/bpftrace
+.PP
+Also look in the bpftrace distribution for a companion _examples.txt file containing
+example usage, output, and commentary for this tool.
+
+This is a bpftrace version of the bcc tool of the same name. The bcc tool
+provides command line options.
+.IP
+https://github.com/iovisor/bcc
+.SH OS
+Linux
+.SH STABILITY
+Unstable - in development.
+.SH AUTHOR
+Brendan Gregg
+.SH SEE ALSO
+tcpdump(8)

tools/gethostlatency.bt

+/*
+ * gethostlatency	Trace getaddrinfo/gethostbyname[2] calls.
+ *			For Linux, uses bpftrace and eBPF.
+ *
+ * This can be useful for identifying DNS latency, by identifying which
+ * remote host name lookups were slow, and by how much.
+ *
+ * This uses dynamic tracing of user-level functions and registers, and may
+ # need modifications to match your software and processor architecture.
+ *
+ * USAGE: gethostlatency.bt
+ *
+ * This is a bpftrace version of the bcc tool of the same name.
+ *
+ * Copyright 2018 Netflix, Inc.
+ * Licensed under the Apache License, Version 2.0 (the "License")
+ *
+ * 08-Sep-2018	Brendan Gregg	Created this.
+ */
+
+BEGIN
+{
+	printf("Tracing getaddr/gethost calls... Hit Ctrl-C to end.\n");
+	printf("%-9s %-6s %-16s %6s %s\n", "TIME", "PID", "COMM", "LATms",
+	    "HOST");
+}
+
+uprobe:/lib/x86_64-linux-gnu/libc.so.6:getaddrinfo,
+uprobe:/lib/x86_64-linux-gnu/libc.so.6:gethostbyname,
+uprobe:/lib/x86_64-linux-gnu/libc.so.6:gethostbyname2
+{
+	@start[tid] = nsecs;
+	@name[tid] = arg0;
+}
+
+uretprobe:/lib/x86_64-linux-gnu/libc.so.6:getaddrinfo,
+uretprobe:/lib/x86_64-linux-gnu/libc.so.6:gethostbyname,
+uretprobe:/lib/x86_64-linux-gnu/libc.so.6:gethostbyname2
+/@start[tid]/
+{
+	$latms = (nsecs - @start[tid]) / 1000000;
+	time("%H:%M:%S  ");
+	printf("%-6d %-16s %6d %s\n", pid, comm, $latms, str(@name[tid]));
+	delete(@start[tid]);
+	delete(@name[tid]);
+}

tools/gethostlatency_example.txt

+Demonstrations of gethostlatency, the Linux bpftrace/eBPF version.
+
+
+This traces host name lookup calls (getaddrinfo(), gethostbyname(), and
+gethostbyname2()), and shows the PID and command performing the lookup, the
+latency (duration) of the call in milliseconds, and the host string:
+
+# bpftrace gethostlatency.bt
+Attaching 7 probes...
+Tracing getaddr/gethost calls... Hit Ctrl-C to end.
+TIME      PID    COMM              LATms HOST
+02:52:05  19105  curl                 81 www.netflix.com
+02:52:12  19111  curl                 17 www.netflix.com
+02:52:19  19116  curl                  9 www.facebook.com
+02:52:23  19118  curl                  3 www.facebook.com
+
+In this example, the first call to lookup "www.netflix.com" took 81 ms, and
+the second took 17 ms (sounds like some caching).
+
+
+There is another version of this tool in bcc: https://github.com/iovisor/bcc
+The bcc version provides options to customize the output.