Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
B
bpftrace
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
0
Merge Requests
0
Analytics
Analytics
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Commits
Issue Boards
Open sidebar
Kirill Smelkov
bpftrace
Commits
d33e6f03
Commit
d33e6f03
authored
Dec 27, 2018
by
Brendan Gregg
Committed by
GitHub
Dec 27, 2018
Browse files
Options
Browse Files
Download
Plain Diff
Merge pull request #296 from danobi/man_page_grammer
Normalize bpftrace(8) man page
parents
54909d3e
5cb72f7d
Changes
1
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
20 additions
and
20 deletions
+20
-20
man/man8/bpftrace.8
man/man8/bpftrace.8
+20
-20
No files found.
man/man8/bpftrace.8
View file @
d33e6f03
...
@@ -52,41 +52,41 @@ See \fBPROBE TYPES\fR and \fBBUILTINS (variables/functions)\fR for the bpftrace
...
@@ -52,41 +52,41 @@ See \fBPROBE TYPES\fR and \fBBUILTINS (variables/functions)\fR for the bpftrace
.
.
.TP
.TP
\fB\-l [searchterm]\fR
\fB\-l [searchterm]\fR
list probes
List probes.
.
.
.TP
.TP
\fB\-e \'PROGRAM\'\fR
\fB\-e \'PROGRAM\'\fR
execute PROGRAM
Execute PROGRAM.
.
.
.TP
.TP
\fB\-p PID\fR
\fB\-p PID\fR
process ID for enabling USDT probes
Process ID for enabling USDT probes.
.
.
.TP
.TP
\fB\-v\fR
\fB\-v\fR
verbose messages
Verbose messages.
.
.
.TP
.TP
\fB\-d\fR
\fB\-d\fR
debug info on dry run
Debug info on dry run.
.
.
.TP
.TP
\fB\-dd\fR
\fB\-dd\fR
verbose debug info on dry run
Verbose debug info on dry run.
.
.
.SH "EXAMPLES"
.SH "EXAMPLES"
.
.
.TP
.TP
\fBbpftrace \-l \'*sleep*\'\fR
\fBbpftrace \-l \'*sleep*\'\fR
list probes containing "sleep"
List probes containing "sleep".
.
.
.TP
.TP
\fBbpftrace \-e \'kprobe:do_nanosleep { printf("PID %d sleeping\en", pid); }\'\fR
\fBbpftrace \-e \'kprobe:do_nanosleep { printf("PID %d sleeping\en", pid); }\'\fR
trace processes calling sleep
Trace processes calling sleep.
.
.
.TP
.TP
\fBbpftrace \-e \'tracepoint:raw_syscalls:sys_enter { @[comm]=count(); }\'\fR
\fBbpftrace \-e \'tracepoint:raw_syscalls:sys_enter { @[comm]=count(); }\'\fR
count syscalls by process name
Count syscalls by process name.
.
.
.SH "ONELINERS"
.SH "ONELINERS"
For brevity, just the the actual BPF code is shown below\.
For brevity, just the the actual BPF code is shown below\.
...
@@ -95,47 +95,47 @@ For brevity, just the the actual BPF code is shown below\.
...
@@ -95,47 +95,47 @@ For brevity, just the the actual BPF code is shown below\.
Usage: \fBbpftrace \-e \'bpf\-code\'\fR
Usage: \fBbpftrace \-e \'bpf\-code\'\fR
.
.
.TP
.TP
New processes with arguments
New processes with arguments
:
\fBtracepoint:syscalls:sys_enter_execve { join(args\->argv); }\fR
\fBtracepoint:syscalls:sys_enter_execve { join(args\->argv); }\fR
.
.
.TP
.TP
Files opened by process
Files opened by process
:
\fBtracepoint:syscalls:sys_enter_open { printf("%s %s\en", comm, str(args\->filename)); }\fR
\fBtracepoint:syscalls:sys_enter_open { printf("%s %s\en", comm, str(args\->filename)); }\fR
.
.
.TP
.TP
Syscall count by program
Syscall count by program
:
\fBtracepoint:raw_syscalls:sys_enter { @[comm] = count(); }\fR
\fBtracepoint:raw_syscalls:sys_enter { @[comm] = count(); }\fR
.
.
.TP
.TP
Syscall count by syscall
Syscall count by syscall
:
\fBtracepoint:syscalls:sys_enter_* { @[probe] = count(); }\fR
\fBtracepoint:syscalls:sys_enter_* { @[probe] = count(); }\fR
.
.
.TP
.TP
Syscall count by process
Syscall count by process
:
\fBtracepoint:raw_syscalls:sys_enter { @[pid, comm] = count(); }\fR
\fBtracepoint:raw_syscalls:sys_enter { @[pid, comm] = count(); }\fR
.
.
.TP
.TP
Read bytes by process
Read bytes by process
:
\fBtracepoint:syscalls:sys_exit_read /args\->ret/ { @[comm] = sum(args\->ret); }\fR
\fBtracepoint:syscalls:sys_exit_read /args\->ret/ { @[comm] = sum(args\->ret); }\fR
.
.
.TP
.TP
Read size distribution by process
Read size distribution by process
:
\fBtracepoint:syscalls:sys_exit_read { @[comm] = hist(args\->ret); }\fR
\fBtracepoint:syscalls:sys_exit_read { @[comm] = hist(args\->ret); }\fR
.
.
.TP
.TP
Disk size by process
Disk size by process
:
\fBtracepoint:block:block_rq_issue { printf("%d %s %d\en", pid, comm, args\->bytes); }\fR
\fBtracepoint:block:block_rq_issue { printf("%d %s %d\en", pid, comm, args\->bytes); }\fR
.
.
.TP
.TP
Pages paged in by process
Pages paged in by process
:
\fBsoftware:major\-faults:1 { @[comm] = count(); }\fR
\fBsoftware:major\-faults:1 { @[comm] = count(); }\fR
.
.
.TP
.TP
Page faults by process
Page faults by process
:
\fBsoftware:faults:1 { @[comm] = count(); }\fR
\fBsoftware:faults:1 { @[comm] = count(); }\fR
.
.
.TP
.TP
Profile user\-level stacks at 99 Hertz, for PID 189
Profile user\-level stacks at 99 Hertz, for PID 189
:
\fBprofile:hz:99 /pid == 189/ { @[ustack] = count(); }\fR
\fBprofile:hz:99 /pid == 189/ { @[ustack] = count(); }\fR
.
.
.SH "PROBE TYPES"
.SH "PROBE TYPES"
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment