FM / examples

/usr/share/doc/bpftrace/examples

Name	Size	Mode	Actions
bashreadline_example.txt	722	0644	edit dl rm
biolatency_example.txt	1790	0644	edit dl rm
biosnoop_example.txt	2056	0644	edit dl rm
biostacks_example.txt	1914	0644	edit dl rm
bitesize_example.txt	3003	0644	edit dl rm
capable_example.txt	2659	0644	edit dl rm
cpuwalk_example.txt	4919	0644	edit dl rm
dcsnoop_example.txt	4612	0644	edit dl rm
execsnoop_example.txt	1535	0644	edit dl rm
gethostlatency_example.txt	923	0644	edit dl rm
killsnoop_example.txt	846	0644	edit dl rm
loads_example.txt	864	0644	edit dl rm
mdflush_example.txt	1866	0644	edit dl rm
naptime_example.txt	844	0644	edit dl rm
oomkill_example.txt	1668	0644	edit dl rm
opensnoop_example.txt	2528	0644	edit dl rm
pidpersec_example.txt	1504	0644	edit dl rm
runqlat_example.txt	8632	0644	edit dl rm
runqlen_example.txt	980	0644	edit dl rm
setuids_example.txt	2441	0644	edit dl rm
ssllatency_example.txt	4510	0644	edit dl rm
sslsnoop_example.txt	1916	0644	edit dl rm
statsnoop_example.txt	2738	0644	edit dl rm
swapin_example.txt	549	0644	edit dl rm
syncsnoop_example.txt	541	0644	edit dl rm
syscount_example.txt	1144	0644	edit dl rm
tcpaccept_example.txt	1350	0644	edit dl rm
tcpconnect_example.txt	1085	0644	edit dl rm
tcpdrop_example.txt	1256	0644	edit dl rm
tcplife_example.txt	1597	0644	edit dl rm
tcpretrans_example.txt	1153	0644	edit dl rm
tcpsynbl_example.txt	940	0644	edit dl rm
threadsnoop_example.txt	1182	0644	edit dl rm
undump_example.txt	680	0644	edit dl rm
vfscount_example.txt	1199	0644	edit dl rm
vfsstat_example.txt	929	0644	edit dl rm
writeback_example.txt	1962	0644	edit dl rm
xfsdist_example.txt	3419	0644	edit dl rm

Edit: /usr/share/doc/bpftrace/examples/vfscount_example.txt (1199B)

Demonstrations of vfscount, the Linux bpftrace/eBPF version.

Tracing all VFS calls:

# ./vfscount.bt
Attaching 54 probes...
cannot attach kprobe, Invalid argument
Warning: could not attach probe kprobe:vfs_dedupe_get_page.isra.21, skipping.
Tracing VFS calls... Hit Ctrl-C to end.
^C

@[vfs_fsync_range]: 4
@[vfs_readlink]: 14
@[vfs_statfs]: 56
@[vfs_lock_file]: 60
@[vfs_write]: 276
@[vfs_statx]: 328
@[vfs_statx_fd]: 394
@[vfs_open]: 541
@[vfs_getattr]: 595
@[vfs_getattr_nosec]: 597
@[vfs_read]: 1113

While tracing, the vfs_read() call was the most frequent, occurring 1,113 times.

VFS is the Virtual File System: a kernel abstraction for file systems and other
resources that expose a file system interface. Much of VFS maps directly to the
syscall interface. Tracing VFS calls gives you a high level breakdown of the
kernel workload, and starting points for further investigation.

Note that a warning was printed: "Warning: could not attach probe
kprobe:vfs_dedupe_get_page.isra.21": these are not currently instrumentable by
bpftrace/kprobes, so a warning is printed to let you know that they will be
missed.

There is another version of this tool in bcc: https://github.com/iovisor/bcc

cmd: