+++ /dev/null
-/*
- * pidpersec.c Count new processes (via fork).
- * For Linux, uses BCC, eBPF. See the Python front-end.
- *
- * USAGE: pidpersec.py
- *
- * Copyright (c) 2015 Brendan Gregg.
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of version 2 of the GNU General Public
- * License as published by the Free Software Foundation.
- *
- * 11-Aug-2015 Brendan Gregg Created this.
- */
-
-#include <uapi/linux/ptrace.h>
-
-enum stat_types {
- S_COUNT = 1,
- S_MAXSTAT
-};
-
-BPF_TABLE("array", int, u64, stats, S_MAXSTAT + 1);
-
-void stats_increment(int key) {
- u64 *leaf = stats.lookup(&key);
- if (leaf) (*leaf)++;
-}
-
-void do_count(struct pt_regs *ctx) { stats_increment(S_COUNT); }
from time import sleep, strftime
# load BPF program
-b = BPF(src_file="pidpersec.c")
+b = BPF(text="""
+#include <uapi/linux/ptrace.h>
+
+enum stat_types {
+ S_COUNT = 1,
+ S_MAXSTAT
+};
+
+BPF_TABLE("array", int, u64, stats, S_MAXSTAT + 1);
+
+void stats_increment(int key) {
+ u64 *leaf = stats.lookup(&key);
+ if (leaf) (*leaf)++;
+}
+
+void do_count(struct pt_regs *ctx) { stats_increment(S_COUNT); }
+""")
b.attach_kprobe(event="sched_fork", fn_name="do_count")
# stat indexes
+++ /dev/null
-/*
- * vfscount.c Count some VFS calls.
- * For Linux, uses BCC, eBPF. See the Python front-end.
- *
- * USAGE: vfscount.py
- *
- * Copyright (c) 2015 Brendan Gregg.
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of version 2 of the GNU General Public
- * License as published by the Free Software Foundation.
- *
- * 14-Aug-2015 Brendan Gregg Created this.
- */
-
-#include <uapi/linux/ptrace.h>
-
-struct key_t {
- u64 ip;
-};
-
-BPF_TABLE("hash", struct key_t, u64, counts, 256);
-
-int do_count(struct pt_regs *ctx) {
- struct key_t key = {};
- u64 zero = 0, *val;
- key.ip = ctx->ip;
- val = counts.lookup_or_init(&key, &zero);
- (*val)++;
- return 0;
-}
from time import sleep
# load BPF program
-b = BPF(src_file="vfscount.c")
+b = BPF(text="""
+#include <uapi/linux/ptrace.h>
+
+struct key_t {
+ u64 ip;
+};
+
+BPF_TABLE("hash", struct key_t, u64, counts, 256);
+
+ int do_count(struct pt_regs *ctx) {
+ struct key_t key = {};
+ u64 zero = 0, *val;
+ key.ip = ctx->ip;
+ val = counts.lookup_or_init(&key, &zero);
+ (*val)++;
+ return 0;
+}
+""")
b.attach_kprobe(event_re="^vfs_.*", fn_name="do_count")
# header
+++ /dev/null
-/*
- * vfsstat.c Count some VFS calls.
- * For Linux, uses BCC, eBPF. See the Python front-end.
- *
- * USAGE: vfsstat.py [interval [count]]
- *
- * Copyright (c) 2015 Brendan Gregg.
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of version 2 of the GNU General Public
- * License as published by the Free Software Foundation.
- *
- * 14-Aug-2015 Brendan Gregg Created this.
- */
-
-#include <uapi/linux/ptrace.h>
-
-enum stat_types {
- S_READ = 1,
- S_WRITE,
- S_FSYNC,
- S_OPEN,
- S_CREATE,
- S_MAXSTAT
-};
-
-BPF_TABLE("array", int, u64, stats, S_MAXSTAT + 1);
-
-void stats_increment(int key) {
- u64 *leaf = stats.lookup(&key);
- if (leaf) (*leaf)++;
-}
-
-void do_read(struct pt_regs *ctx) { stats_increment(S_READ); }
-void do_write(struct pt_regs *ctx) { stats_increment(S_WRITE); }
-void do_fsync(struct pt_regs *ctx) { stats_increment(S_FSYNC); }
-void do_open(struct pt_regs *ctx) { stats_increment(S_OPEN); }
-void do_create(struct pt_regs *ctx) { stats_increment(S_CREATE); }
usage()
# load BPF program
-b = BPF(src_file="vfsstat.c")
+b = BPF(text="""
+#include <uapi/linux/ptrace.h>
+
+enum stat_types {
+ S_READ = 1,
+ S_WRITE,
+ S_FSYNC,
+ S_OPEN,
+ S_CREATE,
+ S_MAXSTAT
+};
+
+BPF_TABLE("array", int, u64, stats, S_MAXSTAT + 1);
+
+void stats_increment(int key) {
+ u64 *leaf = stats.lookup(&key);
+ if (leaf) (*leaf)++;
+}
+
+void do_read(struct pt_regs *ctx) { stats_increment(S_READ); }
+void do_write(struct pt_regs *ctx) { stats_increment(S_WRITE); }
+void do_fsync(struct pt_regs *ctx) { stats_increment(S_FSYNC); }
+void do_open(struct pt_regs *ctx) { stats_increment(S_OPEN); }
+void do_create(struct pt_regs *ctx) { stats_increment(S_CREATE); }
+""")
b.attach_kprobe(event="vfs_read", fn_name="do_read")
b.attach_kprobe(event="vfs_write", fn_name="do_write")
b.attach_kprobe(event="vfs_fsync", fn_name="do_fsync")