Brendan Gregg [Fri, 16 Sep 2016 18:35:09 +0000 (11:35 -0700)]
Merge pull request #689 from chantra/tcpconnect_port
[tcpconnect] filter traced connection based on destination ports
chantra [Sat, 10 Sep 2016 16:44:50 +0000 (09:44 -0700)]
[tcpconnect] filter traced connection based on destination ports
Test:
While running:
while [ 1 ]; do nc -w 1 100.127.0.1 80; nc -w 1 100.127.0.1 81; done
root@vagrant:/mnt/bcc# ./tools/tcpconnect.py
PID COMM IP SADDR DADDR DPORT
19978 nc 4 10.0.2.15 100.127.0.1 80
19979 nc 4 10.0.2.15 100.127.0.1 81
19980 nc 4 10.0.2.15 100.127.0.1 80
19981 nc 4 10.0.2.15 100.127.0.1 81
root@vagrant:/mnt/bcc# ./tools/tcpconnect.py -P 80
PID COMM IP SADDR DADDR DPORT
19987 nc 4 10.0.2.15 100.127.0.1 80
19989 nc 4 10.0.2.15 100.127.0.1 80
19991 nc 4 10.0.2.15 100.127.0.1 80
19993 nc 4 10.0.2.15 100.127.0.1 80
19995 nc 4 10.0.2.15 100.127.0.1 80
root@vagrant:/mnt/bcc# ./tools/tcpconnect.py -P 80,81
PID COMM IP SADDR DADDR DPORT
8725 nc 4 10.0.2.15 100.127.0.1 80
8726 nc 4 10.0.2.15 100.127.0.1 81
8727 nc 4 10.0.2.15 100.127.0.1 80
8728 nc 4 10.0.2.15 100.127.0.1 81
8729 nc 4 10.0.2.15 100.127.0.1 80
Fixes #681
Brendan Gregg [Wed, 14 Sep 2016 15:15:09 +0000 (08:15 -0700)]
new tool: capable (#690)
* add new tool: capable
* refactor a little, remove extra bpf_get_current_pid_tgid()
davidefdl [Mon, 12 Sep 2016 19:00:37 +0000 (12:00 -0700)]
Fix bpf log buffer for large bpf program: (#680)
Use tempfile module to create a temp file
Fix some review input
Fix style check
Style
Style check
Remove builtin module from python test to run fedora ctest
Let the program calling bpf_prog_load to handle the log buffer
Check max instruction before the syscall. Fix other review comment
Brendan Gregg [Sun, 11 Sep 2016 04:37:53 +0000 (21:37 -0700)]
Merge pull request #688 from KarimAllah/opensnoop-re
minor cleanup + process partial name matching
KarimAllah Ahmed [Sat, 10 Sep 2016 10:01:07 +0000 (12:01 +0200)]
opensnoop: Introduce process name filtering
Signed-off-by: KarimAllah Ahmed <karim.allah.ahmed@gmail.com>
KarimAllah Ahmed [Sat, 10 Sep 2016 10:00:32 +0000 (12:00 +0200)]
opensnoop: Refactor initial timestamp calculation
Signed-off-by: KarimAllah Ahmed <karim.allah.ahmed@gmail.com>
KarimAllah Ahmed [Sat, 10 Sep 2016 09:53:46 +0000 (11:53 +0200)]
opensnoop: Remove 'delta' and 'cont' variables
... since they are unused.
Signed-off-by: KarimAllah Ahmed <karim.allah.ahmed@gmail.com>
Brenden Blanco [Fri, 9 Sep 2016 00:58:25 +0000 (20:58 -0400)]
Merge pull request #686 from iovisor/tag_v0.2.0
Prepare debian changelog for v0.2.0 tag
Brenden Blanco [Fri, 9 Sep 2016 00:15:55 +0000 (17:15 -0700)]
Prepare debian changelog for v0.2.0 tag
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
Brendan Gregg [Thu, 8 Sep 2016 23:03:43 +0000 (16:03 -0700)]
Merge pull request #685 from kinvolk/iaguis/fix-indentation
examples: fix indentation in tracing/tcpv4connect
Iago López Galeiras [Thu, 8 Sep 2016 14:45:11 +0000 (16:45 +0200)]
examples: fix indentation in tracing/tcpv4connect
Python doesn't like mixing spaces and tabs.
Brendan Gregg [Tue, 30 Aug 2016 19:18:57 +0000 (12:18 -0700)]
Merge pull request #677 from markdrayton/fileslower
fileslower: use de->d_name.name, add filtering
Mark Drayton [Thu, 25 Aug 2016 19:46:35 +0000 (20:46 +0100)]
fileslower/filetop: use de->d_name.name, add filtering
Brenden Blanco [Thu, 25 Aug 2016 04:01:02 +0000 (00:01 -0400)]
Merge pull request #675 from brendangregg/master
fix biosnoop after kernel change
Brendan Gregg [Wed, 24 Aug 2016 22:10:05 +0000 (15:10 -0700)]
fix biosnoop after kernel change
Brendan Gregg [Wed, 24 Aug 2016 21:56:09 +0000 (14:56 -0700)]
Merge pull request #674 from markdrayton/offcputime
offcputime improvements: use less RAM, add PID/TID support
Mark Drayton [Sun, 31 Jul 2016 21:47:07 +0000 (22:47 +0100)]
offcputime: one symbol cache per process, improve pid/tid handling
Brenden Blanco [Wed, 24 Aug 2016 04:21:53 +0000 (00:21 -0400)]
Merge pull request #670 from iamkafai/perf_submit_skb
Add perf_submit_skb
Martin KaFai Lau [Fri, 19 Aug 2016 22:34:18 +0000 (15:34 -0700)]
Add perf_submit_skb
For BPF_PROG_TYPE_SCHED_CLS/ACT, the upstream kernel has recently added a
feature to efficiently output skb + meta data:
commit
555c8a8623a3 ("bpf: avoid stack copy and use skb ctx for event output")
This patch adds perf_submit_skb to BPF_PERF_OUTPUT macro. It takes
an extra u32 argument. perf_submit_skb will then be expanded to
bpf_perf_event_output properly to consider the newly added
u32 argument as the skb's len.
Other than the above described changes, perf_submit_skb is almost
a carbon copy of the perf_submit except the removal of the 'string name'
variable since I cannot find a specific use of it.
Note that the 3rd param type of bpf_perf_event_output has also been
changed from u32 to u64.
Added a sample program tc_perf_event.py. Here is how the output
looks like:
[root@arch-fb-vm1 networking]# ./tc_perf_event.py
Try: "ping -6 ff02::1%me"
CPU SRC IP DST IP Magic
0 fe80::982f:5dff:fec1:e52b ff02::1 0xfaceb00c
0 fe80::982f:5dff:fec1:e52b ff02::1 0xfaceb00c
0 fe80::982f:5dff:fec1:e52b ff02::1 0xfaceb00c
1 fe80::982f:5dff:fec1:e52b ff02::1 0xfaceb00c
1 fe80::982f:5dff:fec1:e52b ff02::1 0xfaceb00c
1 fe80::982f:5dff:fec1:e52b ff02::1 0xfaceb00c
Brendan Gregg [Sun, 21 Aug 2016 03:20:12 +0000 (20:20 -0700)]
Merge pull request #671 from pchaigno/fix-doc
Minor adjustments to the documentation
Paul Chaignon [Sat, 20 Aug 2016 12:24:03 +0000 (14:24 +0200)]
Mention that tracepoint support requires Linux 4.7
Paul Chaignon [Sat, 20 Aug 2016 12:15:07 +0000 (14:15 +0200)]
Adjustments to the documentation
Fix a few typos
Add missing link
Reword update() description sentence
Brenden Blanco [Fri, 19 Aug 2016 20:02:53 +0000 (13:02 -0700)]
Merge pull request #668 from iovisor/ast_dev
fix build with 4.0 llvm trunk
Alexei Starovoitov [Fri, 19 Aug 2016 02:52:57 +0000 (22:52 -0400)]
fix build with 4.0 llvm trunk
Signed-off-by: Alexei Starovoitov <ast@fb.com>
Brenden Blanco [Thu, 18 Aug 2016 21:33:29 +0000 (14:33 -0700)]
frontends/clang: Safety check for invalid opLoc in ProbeVisitor (#667)
As reported in #664:
In cases where the AST contains a MemberExpr with an invalid opLoc,
rewrite will fail but prior to this change would segfault. Fail a little
more gracefully, even though the program will still be rejected.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
Brendan Gregg [Thu, 18 Aug 2016 20:22:35 +0000 (13:22 -0700)]
Merge pull request #663 from adrianlzt/sniff_ssl_tool
Tool to sniff data contents before encrypted with OpenSSL
Adrian Lopez [Wed, 17 Aug 2016 12:08:08 +0000 (14:08 +0200)]
Add capture for GnuTLS and argparse options
Now it also captures gnutls_record_send and gnutls_record_recv calls.
Added options to filter by pid or command name, or just one lib.
Adrian Lopez [Tue, 16 Aug 2016 15:49:49 +0000 (17:49 +0200)]
Tool to sniff data contents before encrypted with OpenSSL
Add tool as talked in iovisor-dev 'BCC: bpf_probe_read read function arguments'
Adrián López [Mon, 15 Aug 2016 18:58:40 +0000 (20:58 +0200)]
Typo writting BPF (#659)
Brenden Blanco [Mon, 15 Aug 2016 18:58:16 +0000 (11:58 -0700)]
Revert "debian packaging: Build with -DBCC_KERNEL_HAS_SOURCE_DIR=1" (#662)
This reverts commit
c6688dda4e856be43b8651afe92d7e32e63faea9.
Brendan Gregg [Sun, 14 Aug 2016 06:57:01 +0000 (23:57 -0700)]
Merge pull request #661 from oujunli/ojl_dev
killsnoop: use current time replace timestamp and default output
Junli Ou [Sat, 13 Aug 2016 09:12:45 +0000 (17:12 +0800)]
killsnoop: use current time replace timestamp and default output
Brenden Blanco [Thu, 11 Aug 2016 21:02:40 +0000 (14:02 -0700)]
update debian packaging (#657)
* debian packaging: Add missing Build-dependencies
* Add clang-format-3.7 to build-depends
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
* debian packaging: Build with -DBCC_KERNEL_HAS_SOURCE_DIR=1
This is required to use the distro-provided includes on Debian/Ubuntu
Brendan Gregg [Thu, 11 Aug 2016 17:10:55 +0000 (10:10 -0700)]
Merge pull request #655 from markdrayton/dcsnoop
dcsnoop: use PERF_EVENT_OUTPUT
Mark Drayton [Thu, 11 Aug 2016 09:39:03 +0000 (10:39 +0100)]
Merge branch 'master' into dcsnoop
Mark Drayton [Wed, 13 Jul 2016 17:15:05 +0000 (18:15 +0100)]
dcsnoop: use PERF_EVENT_OUTPUT
Brendan Gregg [Thu, 11 Aug 2016 01:04:32 +0000 (18:04 -0700)]
Merge pull request #654 from palmtenor/docs
Add some explanation for functions in BPF program in Tutorial
Teng Qin [Thu, 11 Aug 2016 00:35:28 +0000 (17:35 -0700)]
Improve tutorial
Paul Chaignon [Tue, 9 Aug 2016 16:38:05 +0000 (18:38 +0200)]
Motivate delete() before update() in tutorial (#651)
This delete() is required because of a kernel bug:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=
a6ed3ea65d9868fdf9eff84e6fe4f666b8d14b02
Omar Sandoval [Sat, 6 Aug 2016 03:43:35 +0000 (20:43 -0700)]
Add bpf_get_current_task() helper definition (#650)
Signed-off-by: Omar Sandoval <osandov@fb.com>
Junli Ou [Sat, 6 Aug 2016 03:43:20 +0000 (11:43 +0800)]
funccount: filter bcc function count (#645)
Brenden Blanco [Fri, 5 Aug 2016 04:44:14 +0000 (21:44 -0700)]
Merge pull request #649 from iovisor/ast_dev
fix build with llvm 4.0
Alexei Starovoitov [Fri, 5 Aug 2016 04:01:11 +0000 (00:01 -0400)]
fix build with llvm 4.0
Signed-off-by: Alexei Starovoitov <ast@fb.com>
Teng Qin [Fri, 5 Aug 2016 03:14:13 +0000 (20:14 -0700)]
Add bcc_syms.h to C++ install (#648)
Brenden Blanco [Fri, 5 Aug 2016 03:13:19 +0000 (20:13 -0700)]
Disable static-libstdc++ when clang is linked dynamically (#647)
Based on the bug report in
https://bugs.gentoo.org/show_bug.cgi?id=582770, mixing static+non-static
libstdc++ can lead to crashes. Disable such combinations. Choosing to
leave out the llvm check, since in practice clang is less likely to be
provided statically, so the check should cover both cases.
Fixes: #633
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
Brendan Gregg [Wed, 3 Aug 2016 22:15:41 +0000 (15:15 -0700)]
style nits (#646)
Brenden Blanco [Tue, 2 Aug 2016 21:44:20 +0000 (14:44 -0700)]
Merge pull request #644 from iovisor/dns-update
Update readme with dns name and https for repo server
Brenden Blanco [Tue, 2 Aug 2016 02:22:03 +0000 (19:22 -0700)]
Update readme with dns name and https for repo server
We enabled dns for the repo and builtbot, and then turned on letsencrypt
for those as well. Yay, now we look slightly more official.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
Brenden Blanco [Tue, 2 Aug 2016 01:12:11 +0000 (18:12 -0700)]
add open_perf_event api for reading perf counters (#643)
* add open_perf_event api for reading perf counters
Though the rewriter table method existed, we were not yet opening up the
perf counter in the proper way for it to be read.
Introduce a c function to enable attaching perf counters to cpu-indexed
table slots. The python side opens, assigns, then immediately closes the
fd. Only the kernel keeps a reference, so closing the table or deleting
the entry will be sufficient to free up the fd when finished.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
* Skip perf array hw counter test if unsupported
Hardware counters are not available in all places (some VM
environments), so gracefully skip on the particular error condition.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
Brendan Gregg [Mon, 1 Aug 2016 23:18:40 +0000 (16:18 -0700)]
MySQL USDT tool and example (#642)
* MySQL USDT example and tool
* add nodejs example output
* add reference to mysqld example
Brendan Gregg [Mon, 1 Aug 2016 17:36:31 +0000 (10:36 -0700)]
Merge pull request #641 from igorsugak/master
tutorial: add missing return in hello_world example
Igor Sugak [Mon, 1 Aug 2016 17:19:58 +0000 (10:19 -0700)]
tutorial: add missing return in hello_world example
Brendan Gregg [Mon, 1 Aug 2016 16:37:48 +0000 (09:37 -0700)]
Merge pull request #640 from lcp/fix-docs
Fix typo in the reference guide
Gary Lin [Mon, 1 Aug 2016 08:29:16 +0000 (16:29 +0800)]
Fix typo in the reference guide
Teng Qin [Sun, 31 Jul 2016 17:17:07 +0000 (10:17 -0700)]
Fix tools still referencing ProcUtils (#625)
Recent USDT change removed `procstat.py`, which the `argdist` and `trace` tools are still referencing. This diff moves the only method (`which`) they are using into the `BPF` class.
Also, make `BPF.find_library` not to call `decode()` on `None`.
Teng Qin [Sun, 31 Jul 2016 17:08:07 +0000 (10:08 -0700)]
Try to demangle C++ symbols (#638)
Added a field `demangle_name` in the `bcc_symbol` struct. Calculate its value whenever possible. For C++ programs, this would make outputted stack traces look nicer.
Example: http://pastebin.com/LqT0nP67
Mark Drayton [Sun, 31 Jul 2016 16:51:52 +0000 (17:51 +0100)]
tcpretrans: ntohs dport (#639)
chantra [Fri, 29 Jul 2016 21:10:15 +0000 (14:10 -0700)]
[cachetop] fix stats computation per processes. (#635)
The current logic was only initializing page accesses, mark dirty.. at
the beginning of the method, preventing counters to be ever reset for
each PIDs.
Piggyback https://github.com/iovisor/bcc/pull/615#discussion_r71056842
Tested by running both tools manually.
Brendan Gregg [Fri, 29 Jul 2016 16:58:12 +0000 (09:58 -0700)]
Merge pull request #637 from oujunli/ojl_dev
fix reference_guide.md bpf_get_current_comm search
Junli Ou [Fri, 29 Jul 2016 08:36:04 +0000 (16:36 +0800)]
fix reference_guide.md bpf_get_current_comm search
Brenden Blanco [Fri, 29 Jul 2016 00:09:15 +0000 (17:09 -0700)]
Merge pull request #636 from iovisor/xdp-drop
Add xdp_drop_count example
Brenden Blanco [Thu, 28 Jul 2016 23:33:46 +0000 (16:33 -0700)]
Add support to xdp_drop_count for clsact mode
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
Brenden Blanco [Thu, 28 Jul 2016 22:30:54 +0000 (15:30 -0700)]
Add xdp_drop_count example
This adds the xdp drop count example relicensed under ASL2, along with
some minor modifications to print pkt/s.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
Brenden Blanco [Thu, 28 Jul 2016 20:46:48 +0000 (13:46 -0700)]
Merge pull request #634 from Eichhoernchen/xdp_net-next
Added XDP support to BCC
Jan Rüth [Thu, 28 Jul 2016 20:32:46 +0000 (22:32 +0200)]
This adds XDP support to BCC as currently supported in net-next.
Concretely, it adds two functions to bcc, namely:
`attach_xdp` and `remove_xdp`
which allows to attach an XDP program to a device (given via its name, e.g., en0) (in the future this might change to a specific queue on a device once the kernel offers this interface)
and `remove_xdp` removes a XDP program from a device. Please note that there can currently be only one program attached to the device and attaching another program replaces the previous.
One example is available to test XDP, in networking/xdp which drops all packets an counts for which protocol a packet was dropped (this is taken from the kernel xdp1 example). Please note that you cannot use the network headers defined in <bcc/proto.h> as they cause llvm/clang to generate instructions not available on XDP layer. On XDP layer you do not have an skb yet, so you are operating on the bare packet data.
XDP support is currently limited to only some network adapters, there is the `mlx4` and there is also a patch available for the `e1000` driver.
Brenden Blanco [Wed, 27 Jul 2016 20:07:33 +0000 (13:07 -0700)]
Merge pull request #632 from markdrayton/probe-strings
Probe registration fixes
Mark Drayton [Wed, 27 Jul 2016 02:08:20 +0000 (03:08 +0100)]
Remove asserts on str probe names
`open_kprobes` is a dict of open kprobes. Its keys are strings for normal
probes and a tuple for perf buffers. Normal probes need unregistering on script
exit; perf buffers do not. `cleanup` currently looks for string keys
(specifically type `str`) when working out what to unregister, which is a bit
brittle -- in Python2 strings can be both native `str` and `unicode`, depending
what exactly was passed to `attach-*/detach_*` and whether `from __future__
import unicode_literals` is used (e.g. #623).
This diff makes the API more relaxed by casting the probe name to `str` to
match the expectations of `cleanup`. This works in py2 (with and without
unicode_literals) and py3.
Mark Drayton [Wed, 27 Jul 2016 04:10:15 +0000 (05:10 +0100)]
py3 probe registration compatibility fixes
* rework `_get_kprobe_functions` to avoid unclosed blacklist warning
* rework `cleanup` to avoid changing size of dict while iterating
* make handling return of `bpf_function_name` work in py2 and py3
Brenden Blanco [Wed, 27 Jul 2016 17:44:10 +0000 (10:44 -0700)]
Merge pull request #630 from chantra/cachetop_sort_ui
[cachetop] Display sorting field and order.
Brenden Blanco [Wed, 27 Jul 2016 01:12:51 +0000 (18:12 -0700)]
Merge pull request #631 from brendangregg/refguide
add a reference guide
Brendan Gregg [Tue, 26 Jul 2016 20:44:30 +0000 (13:44 -0700)]
typos
Brendan Gregg [Tue, 26 Jul 2016 20:38:39 +0000 (13:38 -0700)]
fix local links
Brendan Gregg [Tue, 26 Jul 2016 20:25:53 +0000 (13:25 -0700)]
add a reference guide
Brenden Blanco [Tue, 26 Jul 2016 14:49:06 +0000 (07:49 -0700)]
Merge pull request #628 from brendangregg/master
tutorials: end-user, and python developer
chantra [Tue, 26 Jul 2016 01:32:46 +0000 (18:32 -0700)]
[cachetop] Display sorting field and order.
This will make it easier to visualize what is the sorting field
and order
Brendan Gregg [Mon, 25 Jul 2016 23:58:37 +0000 (16:58 -0700)]
remove unused MSG_MAX
Brendan Gregg [Mon, 25 Jul 2016 23:13:51 +0000 (16:13 -0700)]
add uprobe lesson to tutorial
Brendan Gregg [Mon, 25 Jul 2016 23:13:35 +0000 (16:13 -0700)]
fix uprobe examples to read correct argument
Brendan Gregg [Mon, 25 Jul 2016 22:02:32 +0000 (15:02 -0700)]
tutorials: end-user, and python developer
Brenden Blanco [Mon, 25 Jul 2016 21:18:54 +0000 (14:18 -0700)]
Merge pull request #627 from brendangregg/master
merge most .c and .py examples
Brendan Gregg [Sun, 24 Jul 2016 23:19:20 +0000 (16:19 -0700)]
return 0 on hello_worlds
Brendan Gregg [Sun, 24 Jul 2016 20:42:47 +0000 (13:42 -0700)]
add nodejs_http_server.py to README list
Brendan Gregg [Sun, 24 Jul 2016 20:40:25 +0000 (13:40 -0700)]
merge task_switch example
Brendan Gregg [Sun, 24 Jul 2016 20:37:20 +0000 (13:37 -0700)]
merge disksnoop example
Brendan Gregg [Sun, 24 Jul 2016 20:34:40 +0000 (13:34 -0700)]
merge bitehist example
Brendan Gregg [Sun, 24 Jul 2016 17:01:46 +0000 (10:01 -0700)]
Merge pull request #615 from chantra/cachetop
[cachetop] top-like cachestat
chantra [Sat, 23 Jul 2016 13:33:11 +0000 (15:33 +0200)]
[cachetop] fix and doc
* pass -fno-color-diagnostics to clang
* remove unicode import (#623)
* add time to cachetop output
* add keybindings to cachetop.8
* add cachetop links to README.md
chantra [Mon, 18 Jul 2016 22:17:45 +0000 (00:17 +0200)]
[cachetop] add example and man page.
make interval a positional parameter.
Emmanuel Bretelle [Thu, 14 Jul 2016 20:04:57 +0000 (13:04 -0700)]
[cachetop] top-like cachestat
Alike cachestat.py but providing cache stats at the process level.
Brendan Gregg [Sat, 23 Jul 2016 00:11:51 +0000 (17:11 -0700)]
USDT Python API and example (#624)
* Python USDT API
Code from @vmg
* Basic USDT example
* retire procstat.py
* improve/fix USDT exceptions
Brendan Gregg [Fri, 22 Jul 2016 01:13:24 +0000 (18:13 -0700)]
Add profile: a CPU profiler (#620)
* Add profile: a CPU profiler
* move Perf to common class
Brendan Gregg [Tue, 19 Jul 2016 03:19:16 +0000 (20:19 -0700)]
Merge pull request #618 from palmtenor/master
Use errno symbols in offcputime.py
Teng Qin [Mon, 18 Jul 2016 20:21:10 +0000 (13:21 -0700)]
Use errno symbol instead of hard-coded numbers in offcputime.py
Brenden Blanco [Mon, 18 Jul 2016 17:20:43 +0000 (10:20 -0700)]
Merge pull request #614 from markdrayton/fix-auto-kprobe
Fix probe detaching and auto-kprobes
Mark Drayton [Fri, 15 Jul 2016 22:55:22 +0000 (23:55 +0100)]
Move open_{kprobes,uprobes,tracepoints} into BPF object
* for #605, this diff moves probe storage from the BPF module to the BPF object,
letting each instantiation clean up its own probes. A module-level counter
for all open probes is provided for the quota check. It also adds a
`cleanup()` function to force cleanup before the `atexit` handler runs.
* for #614, it removes the `len(open_kprobes) == 0` check that prevented more
than one autoload probe working. It fixes the tests that this change breaks by
calling the `cleanup()` function added.
Mark Drayton [Fri, 15 Jul 2016 20:19:07 +0000 (21:19 +0100)]
Store kprobes with string keys, fix num_open_kprobes
Prior to this diff we used inconsistent types for keys in `open_kprobes`. The
results from the regex match (`attach_kprobe(event_re=..)`) and the automatic
`kprobe__` features were passed through `str.decode()`, yielding unicode keys,
but specific matches (i.e. from `attach_kprobe(event=..)`) were stored with
string keys passed down from the caller. Only probes under string keys were
released in `cleanup_kprobes`, leaving attached probes on program exit.
This diff makes all the keys regular strings. I erred on the side of using
regular strings over `str.decode()`ing them because a) this data isn't passed
outside of Python, b) it's more Python 3 compatible (there is no `.decode()` on
a regular string object in Python 3 so such a change would ultimately need
removing again).
I also cleaned up a few other things:
* removed the call to `awk` for getting probable functions
* removed the `isinstance` checks when cleaning uprobes/tracepoints -- we
should only have string keys in these dicts
* made `num_open_kprobes` skip the perf_events buffers. People likely use this
to check that the right number of probes have been placed so counting
perf_events buffers doesn't make sense here
Brendan Gregg [Thu, 14 Jul 2016 17:13:12 +0000 (10:13 -0700)]
Merge pull request #611 from cdown/failed_opens
killsnoop: s/failed opens/failed kill syscalls/
Chris Down [Thu, 14 Jul 2016 08:08:48 +0000 (09:08 +0100)]
Merge branch 'master' into failed_opens
Brendan Gregg [Wed, 13 Jul 2016 19:05:24 +0000 (12:05 -0700)]
Merge pull request #612 from markdrayton/fileslower
fileslower: try probing vfs_write if __vfs_write is missing