Brenden Blanco [Sat, 11 Mar 2017 20:05:30 +0000 (12:05 -0800)]
Merge pull request #1032 from goldshtn/tools-tests
Smoke tests for the tools
Sasha Goldshtein [Tue, 14 Feb 2017 01:09:05 +0000 (20:09 -0500)]
tests: Add smoke tests for most tools
This commit adds basic smoke tests for most tools in tools/ by
running the tool with either a short duration, or interrupting it
with a SIGINT after a short duration. The tests check the return
value from the tool to detect any Python exceptions or other
errors, but they do not read the standard error or standard output
and parse the tool's result.
Some tools are not covered by these smoke tests for reasons
documented in the test itself:
* btrfsdist and btrfsslower need btrfs
* cachetop doesn't like to run without a terminal
* dbslower, dbstat, and mysqld_qslower need a database engine
* deadlock_detector allocates a huge amount of memory
* softirqs doesn't work on new kernels and needs fixing (#1031)
* ugc needs a USDT-enabled runtime with GC probes
* zfsdist and zfsslower need zfs
This is a good place to start, but clearly for some tools,
especially those with a complex interface like trace and argdist,
we need more than just basic smoke tests.
Sasha Goldshtein [Tue, 14 Feb 2017 01:25:32 +0000 (20:25 -0500)]
trace: Exit with nonzero return code on error
4ast [Sat, 11 Mar 2017 00:44:03 +0000 (16:44 -0800)]
Merge pull request #1044 from goldshtn/ausyscall
syscount: Use ausyscalls if available to get syscall list
Brendan Gregg [Fri, 10 Mar 2017 20:55:04 +0000 (12:55 -0800)]
Merge pull request #1043 from goldshtn/bpflist
bpflist: Display processes with running BPF programs and maps
Brenden Blanco [Fri, 10 Mar 2017 02:07:20 +0000 (18:07 -0800)]
Merge pull request #1039 from iovisor/tag_v0.3.0
Prepare debian changelog for v0.3.0 tag
Brenden Blanco [Thu, 9 Mar 2017 19:10:20 +0000 (11:10 -0800)]
Prepare debian changelog for v0.3.0 tag
Signed-off-by: Brenden Blanco <bblanco@gmail.com>
Sasha Goldshtein [Thu, 9 Mar 2017 14:37:50 +0000 (14:37 +0000)]
bpflist: Display processes with running BPF programs and maps
This tool displays processes with running BPF programs and maps,
and also optionally kprobes and uprobes. This is a poor-man's version
that snoops BPF file descriptors, as proposed by @brendangregg.
Example:
```
PID COMM TYPE COUNT
4058 fileslower prog 4
4058 fileslower map 2
4106 bashreadline map 1
4106 bashreadline prog 1
```
Resolves #1036.
Sasha Goldshtein [Thu, 9 Mar 2017 13:43:27 +0000 (13:43 +0000)]
syscount: Use ausyscalls if available to get syscall list
If ausyscall is installed, it can provide a clean, up-to-date list of
syscall numbers for the current architecture. This is much more useful
than the default hardcoded list for x86-64, which is currently used by
syscount.
Try to run `ausyscall --dump` and parse the output before resorting to
the static list. Tested on FC/Linux 4.9 and produces 327 syscalls.
Resolves #1001.
4ast [Thu, 9 Mar 2017 00:27:38 +0000 (16:27 -0800)]
Merge pull request #1034 from brendangregg/master
funclatency: remove unnecessary include
4ast [Thu, 9 Mar 2017 00:25:05 +0000 (16:25 -0800)]
Merge pull request #1030 from zvonkok/zvonkok-s390x
Added s390x support. Needs 4.10 Kernel
Brendan Gregg [Wed, 8 Mar 2017 19:17:00 +0000 (11:17 -0800)]
funclatency: remove unnecessary include
Zvonko Kosic [Tue, 7 Mar 2017 06:30:25 +0000 (07:30 +0100)]
Added s390x support. Needs 4.10 Kernel
Brenden Blanco [Tue, 7 Mar 2017 00:14:19 +0000 (16:14 -0800)]
Merge pull request #1005 from pchaigno/rewrite-only-deref
Restrict rewrite of unary operators to dereference operator
Paul Chaignon [Thu, 23 Feb 2017 09:03:58 +0000 (10:03 +0100)]
Restrict rewrite of unary operators to dereference operator
Since the whole expression, unary operator included, is replaced by a
call to bpf_probe_read, the dereference operator is currently the
only unary operator properly rewritten. When rewriting an increment
expression (++val) for instance, the increment operator is lost in
translation.
Trying to rewrite all unary operators sometimes confuses bcc and
results in improper code, for instance when trying to rewrite a
logical negation.
Brenden Blanco [Mon, 6 Mar 2017 18:58:19 +0000 (10:58 -0800)]
Merge pull request #1027 from fajs/debuild_no_parallel_tests
debuild: Do not parallelize tests
Florian Schmidt [Mon, 6 Mar 2017 16:30:55 +0000 (17:30 +0100)]
debuild: Do not parallelize tests
The tests in the test suite are not parallelizable and will fail if run
in parallel. Make the test step non-parallel to fix this issue.
Brenden Blanco [Mon, 6 Mar 2017 16:20:11 +0000 (08:20 -0800)]
Merge pull request #1006 from pchaigno/fix-bpf_dins_pkt-rewrite
Fix bpf_dins_pkt rewrite in BinaryOperator
Brenden Blanco [Mon, 6 Mar 2017 16:16:11 +0000 (08:16 -0800)]
Merge pull request #1024 from r4f4/explicit-static
cmake: Explicitly mark static libraries as such
4ast [Sun, 5 Mar 2017 23:34:41 +0000 (15:34 -0800)]
Merge pull request #1023 from dneiter/filetop_sort
filetop: support specifying sort column via cmdline argument
Rafael Fonseca [Sun, 5 Mar 2017 17:09:54 +0000 (18:09 +0100)]
cmake: Explicitly mark static libraries as such
Some distros (e.g Fedora) override the default behaviour of building
static libraries to building dynamic ones instead. By explicitly
building the correct libraries as static, we make sure BCC properly
compiles everywhere.
Paul Chaignon [Thu, 23 Feb 2017 19:06:03 +0000 (20:06 +0100)]
Fix bpf_dins_pkt rewrite in BinaryOperator
Binary operator expressions where the left hand-side expression is a
reference to the packet are replaced by a call to the bpf_dins_pkt
helper. When replacing text, the Clang Rewriter tries to maintain a
list of offsets between the original and the new position of tokens.
Replacing the whole binary operator expression with the call to
bpf_dins_pkt confuses the Rewriter and it is unable to track the new
position of the right hand-side expression. Rewriting the binary
operator expression in two times without rewriting the right
hand-side expression itself solves the issue.
Paul Chaignon [Sat, 4 Mar 2017 19:07:56 +0000 (20:07 +0100)]
Travis CI build to check compliance with PEP8 (#987)
* Travis CI build to check compliance with PEP8
* argdist: linter cleanup
* dbslower: linter cleanup
* dbstat: linter cleanup
* memleak: linter cleanup
* syscount: linter cleanup
* tplist: linter cleanup
* trace: linter cleanup
* ucalls: linter cleanup
* uflow: linter cleanup
* ugc: linter cleanup
* uobjnew: linter cleanup
* ustat: linter cleanup
Brendan Gregg [Sat, 4 Mar 2017 08:31:58 +0000 (00:31 -0800)]
offwaketime.py for older kernels (#977)
4ast [Sat, 4 Mar 2017 05:27:16 +0000 (21:27 -0800)]
Merge pull request #1021 from markdrayton/sym-mod-fix
python: handle null module in BPF.sym
4ast [Sat, 4 Mar 2017 05:26:11 +0000 (21:26 -0800)]
Merge pull request #1022 from goldshtn/syms-multiple-regions
Symbol resolution with multiple executable regions per module
Brenden Blanco [Fri, 3 Mar 2017 20:42:04 +0000 (12:42 -0800)]
Merge pull request #1018 from GabrielGanne/python-xdp-return-values
add XDP return values to python interface
Sasha Goldshtein [Fri, 3 Mar 2017 20:13:31 +0000 (15:13 -0500)]
cc: Symbol resolution with multiple executable regions per module
The symbol resolution code used to assume for most purposes that
there is a single executable region per module. When there were
several, there was no crash, but symbols were not resolved correctly.
The reason is that the symbol offsets are relative to the first
executable region's start address, but bcc would resolve them
relative to the region in which they appeared. For example, given
the following regions and spans for a module libfoo.so loaded into
some process:
1000-2000 r-xp libfoo.so
2000-3000 rw-p libfoo.so
3000-4000 r-xp libfoo.so
4000-5000 r--- libfoo.so
Now, suppose there is a symbol bar() loaded at address 3500. In
the binary on disk, bar() is at offset 2500 from the beginning of
the module (but not the beginning of the 3000-4000 region!). When
we look at the candidate regions, we find 3000-4000, and discover
that 3500 lies within it. Then we subtract 3500-3000 to find the
offset from the beginning of the region, get 500, and now look
for a symbol that contains the relative address 500. As a result,
we might find some random symbol in the region 1000-2000, and
report that address 3500 corresponds to that random symbol rather
than to bar().
This commit fixes the situation by keeping only a single `Module`
instance for each module, even if that module spans multiple
executable regions. We remember all executable region start and
end ranges so we can determine whether an address (like 3500 in
the above example) lies within the module. But for the purpose of
finding the actual symbol, we need only the offset from the start
of the _first_ executable region, and then need to look up a symbol
based on that.
This was discovered and fixed while tracing .NET Core processes on
Linux, where libcoreclr.so (the main CLR binary) has several
executable regions. Resolving symbols from any but the first region
would produce totally bogus results.
Sasha Goldshtein [Fri, 3 Mar 2017 20:13:16 +0000 (15:13 -0500)]
cc: Fix assertion for debug builds
Rafael F [Fri, 3 Mar 2017 18:57:28 +0000 (19:57 +0100)]
range Python 2 -> 3 compatibility (#983)
Rafael F [Fri, 3 Mar 2017 18:56:50 +0000 (19:56 +0100)]
usdt: fix argument passing on python3 (#984)
This fixes the following error:
$: ./tplist -v -v -l /usr/lib64/dri/i965_dri.so
argument 1: <class 'TypeError'>: wrong type
Alan Thompson [Fri, 3 Mar 2017 18:55:42 +0000 (12:55 -0600)]
Update tutorial_bcc_python_developer.md (#1017)
small typo
Brenden Blanco [Fri, 3 Mar 2017 18:54:13 +0000 (10:54 -0800)]
Merge pull request #1020 from goldshtn/duplicate_modules
cc: Don't parse the same module multiple times for USDT probes
Sasha Goldshtein [Fri, 3 Mar 2017 13:00:55 +0000 (08:00 -0500)]
cc: Don't parse the same module multiple times for USDT probes
If a module has more than one executable region, it is reported
multiple times by `bcc_procutils_each_module`. This is fine for
symbol resolution, but we don't need the duplicates for parsing
the ELF header looking for USDT probes: the first appearance of
that module is enough. This also prevents issues with the same
probe appearing multiple times with the same location, which
results in an invalid program when reading USDT arguments.
Fix by storing each visited module in the USDT::Context class,
and ignoring modules that were already visited.
Gabriel Ganne [Mon, 27 Feb 2017 18:33:49 +0000 (19:33 +0100)]
add XDP return values to python interface
Signed-off-by: Gabriel Ganne <gabriel.ganne@enea.com>
Signed-off-by: Romain Ly <romain.ly@enea.com>
Mark Drayton [Thu, 2 Mar 2017 11:41:31 +0000 (03:41 -0800)]
python: handle null module in BPF.sym
Check to see if `module` is None before attempting to call `os.path.basename`
on it. Before:
```
>>> BPF.sym(0x400001, 12345, show_module=True)
Traceback (most recent call last):
..
AttributeError: 'NoneType' object has no attribute 'rfind'
```
After:
```
>>> BPF.sym(0x400001, 12345, show_module=True)
'[unknown]'
```
Daniel Neiter [Thu, 2 Mar 2017 01:21:25 +0000 (17:21 -0800)]
filetop: support specifying sort column via cmdline argument
4ast [Thu, 2 Mar 2017 00:47:28 +0000 (16:47 -0800)]
Merge pull request #1015 from goldshtn/perfmap-retry
cc: Retry symbol resolution using perfmap
4ast [Wed, 1 Mar 2017 18:08:45 +0000 (10:08 -0800)]
Merge pull request #1002 from goldshtn/nested-symbols
cc: Handle nested functions correctly when resolving symbols
4ast [Tue, 28 Feb 2017 23:46:45 +0000 (15:46 -0800)]
Merge pull request #1012 from goldshtn/buildid-fix
cc: Fix SEGV when there is no build-id section
4ast [Tue, 28 Feb 2017 23:14:50 +0000 (15:14 -0800)]
Merge pull request #1014 from iovisor/test-debuginfo-fix
Fix long running test_debuginfo and python3 fix
Brenden Blanco [Tue, 28 Feb 2017 20:22:42 +0000 (12:22 -0800)]
Fix long running test_debuginfo and python3 fix
Make sure subclass calls super().tearDown to clean up dummy process.
Also, fixup a python3 str.encode().
Fixes: #1013
Signed-off-by: Brenden Blanco <bblanco@gmail.com>
Sasha Goldshtein [Tue, 28 Feb 2017 19:16:49 +0000 (14:16 -0500)]
cc: Retry symbol resolution using perfmap
When a symbol lies within a module, and that module doesn't have
debuginfo (or doesn't even have an ELF header), the symbol will
always be resolved as [unknown]. However, the /tmp/perf-PID.map
(perf map) for that process might actually have an entry for that
symbol, if it was dynamically generated by some external tool.
This commit changes the resolution process such that if the desired
address lies in a module but that module doesn't have debuginfo,
we keep trying to resolve it in subsequent modules (including the
perf map). If we resolve it successfully using the perf map, the
reported symbol information will have the original module's name,
so we don't lose fidelity.
The motivation for this change is the way symbols work with .NET
Core on Linux. The runtime binaries are compiled ahead-of-time to
native code, but do not have debuginfo. There is an external tool,
which generates a file similar to a perf map (albeit with relative
addresses) for these binaries. This file can then be merged into
the main perf map for the process and used for symbol resolution,
but only if we keep trying to use the perf map when the symbol is
in a previously-seen module.
Brenden Blanco [Tue, 28 Feb 2017 16:53:41 +0000 (08:53 -0800)]
Merge pull request #997 from markdrayton/perf-buffer-size
Make perf ring buffer size configurable
Mark Drayton [Mon, 20 Feb 2017 18:13:03 +0000 (18:13 +0000)]
Make perf ring buffer size configurable
As discussed in #966, this PR makes the size of the ring buffer used to send
data to userspace configurable. It changes the Python, Lua and C++ APIs to
expose this knob.
It also defaults the buffer size to a larger value (64 pages per CPU, an 8x
increase) for several tools which produce a lot of output, as well as making it
configurable in `trace` via a `-b` flag.
Brenden Blanco [Sun, 26 Feb 2017 22:32:25 +0000 (14:32 -0800)]
Merge pull request #1003 from ColinIanKing/master
snapcraft: add in some new tools missing from the snapcraft apps list
Brenden Blanco [Sun, 26 Feb 2017 21:58:58 +0000 (13:58 -0800)]
Merge pull request #1008 from pchaigno/support-macro
Support for macros in rewriter
Paul Chaignon [Sun, 26 Feb 2017 11:22:03 +0000 (12:22 +0100)]
Support for macros in rewriter
Extends the scope of
98b90974625's fix to support macros anywhere in the
rewriter. All SourceRange objects are replaced to use macro expanded locations.
4ast [Thu, 23 Feb 2017 17:42:20 +0000 (09:42 -0800)]
Merge pull request #994 from qmonnet/kernelfeatures
docs: Update eBPF features list
Quentin Monnet [Tue, 21 Feb 2017 11:58:33 +0000 (12:58 +0100)]
docs: Update eBPF features list
Update of BPF features list, following the release of kernel 4.10.
Colin Ian King [Thu, 23 Feb 2017 11:49:41 +0000 (11:49 +0000)]
snapcraft: add in some new tools missing from the snapcraft apps list
Add in syscount, dbstat and dbslower to apps list.
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Sasha Goldshtein [Thu, 23 Feb 2017 10:17:08 +0000 (10:17 +0000)]
cc: Handle nested functions correctly when resolving symbols
`ProcSyms::Module::find_addr` incorrectly resolves symbols when
functions are nested in each other. Specifically, this was discovered
with libpthread, where there are multiple symbols for `write`,
where `write_nocancel` is strictly nested inside `write`. Fix by
explicitly going backward until we reach a matching symbol -- see
details in `ProcSyms::Module::find_addr` comments.
4ast [Wed, 22 Feb 2017 22:38:03 +0000 (14:38 -0800)]
Merge pull request #999 from markdrayton/perf-map-anon
Improve matching of file-backed memory mappings
Mark Drayton [Wed, 22 Feb 2017 02:05:10 +0000 (02:05 +0000)]
Improve matching of file-backed memory mappings
Use the same rules as perf to determine if a mapping in /proc/pid/maps is
file-backed. This allows mappings in anonymous huge pages and so on to fall
back to resolving from /tmp/perf-pid.map, if appropriate.
ref: http://lxr.free-electrons.com/source/tools/perf/util/map.c#L28
4ast [Tue, 21 Feb 2017 22:42:44 +0000 (14:42 -0800)]
Merge pull request #996 from markdrayton/fix-find-buildid
Fix "for loop initial declarations only in C99" compile error
4ast [Tue, 21 Feb 2017 22:31:13 +0000 (14:31 -0800)]
Merge pull request #995 from pchaigno/patch-1
Fix minor error in test instructions
Mark Drayton [Tue, 21 Feb 2017 22:25:57 +0000 (22:25 +0000)]
Fix "for loop initial declarations only in C99" compile error
Paul Chaignon [Tue, 21 Feb 2017 21:50:09 +0000 (22:50 +0100)]
Fix error in test instructions
4ast [Tue, 21 Feb 2017 19:18:41 +0000 (11:18 -0800)]
Merge pull request #967 from goldshtn/debuginfo
External debuginfo support and general symbols overhaul
Sasha Goldshtein [Thu, 9 Feb 2017 20:59:47 +0000 (15:59 -0500)]
tests: Test debuginfo through debuglink and build-id sections
This commit introduces support for tests of the new debuglink and
build-id debuginfo resolution functionality. The tests build a
dummy.c file with a debuglink section, and again with a build-id
section, and make sure that the symbol resolution code can locate
the debug information correctly (in the binary's directory for
debuglink, and in /usr/lib/debug/.build-id for the build-id).
Sasha Goldshtein [Thu, 9 Feb 2017 21:32:56 +0000 (16:32 -0500)]
Fix symbol resolution by name (SymbolCache.resolve_name)
The implementation of `ProcSyms::resolve_name` was only valid for
kernel symbols, when there is no module. When a module was provided,
it would segfault due to the module being null. Fixed by making
`bcc_symcache_resolve_name` take an additional module parameter,
which, for kernel symbols, is simply null (`None` from Python).
Sasha Goldshtein [Thu, 9 Feb 2017 08:58:09 +0000 (03:58 -0500)]
cc: Resolve symbols from external debuginfo
Adds support for resolving symbols using external debuginfo files,
which can be retrieved from two locations. First, check the build-id
of the desired binary and look in /usr/lib/debug/.build-id according
to the build-id structure. Second, check the debuglink section of
the desired binary and look in /usr/lib/debug or in the binary's
current directory. These are the rules applied by GDB as well, but
GDB lets the user reconfigure the debug directory path from
/usr/lib/debug to something else; we do not support this.
These changes are based on the following description of how GDB
resolves external debuginfo:
https://sourceware.org/gdb/onlinedocs/gdb/Separate-Debug-Files.html
Sasha Goldshtein [Thu, 9 Feb 2017 06:18:34 +0000 (01:18 -0500)]
cc: Correctly treat PIE files as shared objects for symbols
When resolving symbols, ProcSyms would treat position-independent
executables (PIE files) incorrectly, resulting in symbol resolution
failures. Specifically, PIE files are treated like shared objects
for ASLR, which means all symbol addresses in the file need to be
taken relative to the executable load address at runtime, the same
as with dynamic library shared objects.
The fix is in the `is_so()` method on `ProcSyms::Module`, which
now uses the correct `bcc_elf_is_shared` helper for testing if a
file is a shared object rather than just looking at the extension
".so", which is very brittle -- and wrong.
Sasha Goldshtein [Thu, 9 Feb 2017 05:21:49 +0000 (00:21 -0500)]
trace: Migrate to new symbols API and remove addresses from stacks
Sasha Goldshtein [Thu, 9 Feb 2017 05:20:56 +0000 (00:20 -0500)]
off{cpu,wake}time: Migrate to new symbols API and remove addresses
Remove addresses from stack output, as these are not used in the
vast majority of the cases.
Sasha Goldshtein [Thu, 9 Feb 2017 04:25:28 +0000 (23:25 -0500)]
uthreads: Migrate to new symbols API and include module name
Sasha Goldshtein [Thu, 9 Feb 2017 04:25:00 +0000 (23:25 -0500)]
stacksnoop: Migrate to new symbols API and remove addresses
Sasha Goldshtein [Thu, 9 Feb 2017 04:24:23 +0000 (23:24 -0500)]
stackcount: Migrate to new symbol resolution API
Sasha Goldshtein [Thu, 9 Feb 2017 04:23:20 +0000 (23:23 -0500)]
profile: Migrate to new symbol API and remove addresses
The default profile output used to include stack addresses,
which are not used in 99+% of the cases.
Sasha Goldshtein [Thu, 9 Feb 2017 04:22:06 +0000 (23:22 -0500)]
memleak: Migrate to new symbols resolution API
Remove usyms.py dependency and replace with new symbols API.
Sasha Goldshtein [Thu, 9 Feb 2017 01:56:09 +0000 (20:56 -0500)]
Simplify BCC symbol resolution API
The new API has two main methods: `sym` and `ksym` (the second is
a trivial wrapper of the first one). Both methods accept two
Boolean flags arguments: `show_module` and `show_address`. The first
controls whether the resulting symbol name should contain the name
of the symbol's module, in brackets. For kernel symbols, this is
simply "[kernel]". The second controls whether the resulting symbol
name should contain the instruction offset from the beginning of
the symbol, e.g. "start_thread+0x202".
Sasha Goldshtein [Thu, 9 Feb 2017 01:54:56 +0000 (20:54 -0500)]
Remove usyms.py and redundant ProcessSymbols class
This class was obsolete and replaced by the SymbolCache class.
4ast [Tue, 21 Feb 2017 07:58:42 +0000 (23:58 -0800)]
Merge pull request #988 from goldshtn/usdt-addressed-arg
Support base + index * scale addressing for USDT arguments
4ast [Mon, 20 Feb 2017 19:04:17 +0000 (11:04 -0800)]
Merge pull request #992 from goldshtn/trace-argdist-usdt-arg
trace, argdist: Treat small USDT arguments correctly
Sasha Goldshtein [Mon, 20 Feb 2017 15:42:57 +0000 (15:42 +0000)]
trace, argdist: Treat small USDT arguments correctly
trace and argdist currently only work correctly for USDT arguments
whose size is exactly 8 bytes. Smaller types, such as chars, shorts,
ints (signed or unsigned) are not treated correctly. The reason is
that the produced program would invoke the `bpf_usdt_readarg` helper
with the address of a u64 local variable, and then cast that variable
to the user-specified type derived from the format string. However,
the `bpf_usdt_readarg` rewriting then passes `sizeof(u64)` to the
generated `bpf_..._readarg` macro, which then fails to read anything
because the provided size doesn't match the argument size it knows
about.
The fix is fairly easy: instead of declaring a u64 unconditionally
and reading into that variable with `bpf_usdt_readarg`, declare a
variable that has the correct type according to what we know about
the USDT probe.
4ast [Mon, 20 Feb 2017 07:16:24 +0000 (23:16 -0800)]
Merge pull request #989 from pchaigno/fix-fd-leak
Fix file descriptor leak
Paul Chaignon [Mon, 20 Feb 2017 07:00:28 +0000 (08:00 +0100)]
Fix file descriptor leak
Sasha Goldshtein [Sun, 19 Feb 2017 20:29:45 +0000 (20:29 +0000)]
Support base + index * scale addressing for USDT arguments
It turns out that some software will have USDT probe arguments
referencing memory using the full `nnn@(%basereg + %idxreg * scale`
syntax. This is represented as `nnn@(%basereg,%idxreg,scale)` in
the `NT_STAPSDT` note, encountered in building a recent version of
PostgreSQL on FC25.
This format is now recognized by the USDT parser, and the correct
BPF code is emitted to retrieve arguments that reference memory
using this full addressing syntax.`
Brenden Blanco [Thu, 16 Feb 2017 22:56:52 +0000 (14:56 -0800)]
Merge pull request #972 from r4f4/fix-llcstat
llcstat: fix TypeError on python3
Brendan Gregg [Thu, 16 Feb 2017 19:45:31 +0000 (11:45 -0800)]
Merge pull request #970 from goldshtn/db-tools
dbslower and dbstat
Brendan Gregg [Thu, 16 Feb 2017 18:34:49 +0000 (10:34 -0800)]
Merge branch 'master' into db-tools
Brenden Blanco [Thu, 16 Feb 2017 16:19:44 +0000 (08:19 -0800)]
Merge pull request #971 from goldshtn/syscount
syscount: Summarize syscall counts and latencies
Brenden Blanco [Thu, 16 Feb 2017 16:16:26 +0000 (08:16 -0800)]
Merge pull request #982 from irregulator/master
Adds zlib1g-dev Debian package build dependency
Alexandros [Thu, 16 Feb 2017 10:47:27 +0000 (12:47 +0200)]
Adds zlib1g-dev Debian package build dependency
When building from source in Debian, zlib1g-dev is needed or else
'/usr/bin/ld: cannot find -lz' error will occur.
Sasha Goldshtein [Thu, 9 Feb 2017 15:11:50 +0000 (10:11 -0500)]
syscount: Summarize syscall counts and latencies
This new tool attaches to the raw_syscalls:sys_enter and sys_exit
tracepoints, and collects frequency counts and optionally latencies
of syscalls (aggregated by syscall or by process). It is a fairly
natural and efficient extension of Brendan Gregg's syscount from
perf-tools. Options include latency tracing, interval printouts,
process filtering, summarizing only failed syscalls, and more.
NOTE:
The translation of syscall numbers to names is performed using a
static list, borrowed from strace sources. It is accurate up to
syscall 313, and does not include the bpf() syscall, for example.
Also, it is only relevant for x86_64.
Basic example:
```
$ syscount -P
Tracing syscalls, printing top 10... Ctrl+C to quit.
[10:13:21]
PID COMM COUNT
30216 sshd 533
31391 vi 494
25188 screen 134
25776 mysqld 24
31394 python 10
494 systemd-journal 5
^C
$ syscount -L
Tracing syscalls, printing top 10... Ctrl+C to quit.
[10:13:34]
SYSCALL COUNT TIME (us)
select 132 1902458.009
nanosleep 166 11136.305
write 89 41.308
ftruncate 1 33.217
stat 1 22.117
fstat 1 6.134
[unknown: 321] 28 4.553
ioctl 7 4.544
wait4 166 3.962
timerfd_settime 1 3.786
^C
```
Related: #786
Sasha Goldshtein [Thu, 9 Feb 2017 15:25:20 +0000 (10:25 -0500)]
README: Add dbstat and dbslower and minor fix-ups
Sasha Goldshtein [Thu, 9 Feb 2017 11:21:43 +0000 (06:21 -0500)]
dbstat: Collect histograms of MySQL/PostgreSQL query latencies
This tool traces MySQL/PostgreSQL queries, and aggregates their
latencies into a histogram. The histogram is then printed when the
tool is stopped, or at user-specified intervals.
Sasha Goldshtein [Thu, 9 Feb 2017 10:44:43 +0000 (05:44 -0500)]
dbslower: MySQL/PostgreSQL query tracing tool
This tool traces MySQL/PostgreSQL queries, including an optional
minimum duration threshold. This is based on `mysqld_qslower` but
adapted to automatically detect MySQL/PostgreSQL processes, and a
couple of other code fixes.
I believe at this time, `mysqld_qslower` can be retired, as this
tool completely supersedes it.
Brenden Blanco [Wed, 15 Feb 2017 16:45:29 +0000 (08:45 -0800)]
Merge pull request #974 from r4f4/fix-undo
Revert "undo rebase"
Rafael Fonseca [Wed, 15 Feb 2017 16:28:26 +0000 (17:28 +0100)]
Revert "undo rebase"
This reverts commit
a112514cba8e4844c405e3f1bd341289c4d2a158.
The changes the commit reverted are legit and should not have been
reverted.
Brenden Blanco [Wed, 15 Feb 2017 15:10:56 +0000 (07:10 -0800)]
Merge pull request #969 from goldshtn/clock-monotonic
Move monotonic_time to BPF class, use CLOCK_MONOTONIC
Rafael Fonseca [Wed, 15 Feb 2017 14:20:52 +0000 (15:20 +0100)]
llcstat: fix TypeError on python3
The bytes object has no __format__ method of its own, inheriting it from
object, so an exception is thrown in python3 when it's passed to a
formatted string since formatting instructions are type specific.
$: ./llcstat
Running for 10 seconds or hit Ctrl-C to end.
PID NAME CPU REFERENCE MISS HIT%
Traceback (most recent call last):
File "./llcstat", line 108, in <module>
(float(hit) / float(v.value)) * 100.0))
TypeError: non-empty format string passed to object.__format__
Brenden Blanco [Tue, 14 Feb 2017 21:46:28 +0000 (13:46 -0800)]
Merge pull request #968 from mslusarz/deb-pkg-config
Add pkg-config file to Debian packages.
Marcin Ślusarz [Tue, 14 Feb 2017 20:05:49 +0000 (21:05 +0100)]
Add pkg-config file to Debian packages.
Brenden Blanco [Tue, 14 Feb 2017 16:50:53 +0000 (08:50 -0800)]
Merge pull request #942 from r4f4/fix-filetop
filetop: Fix TypeError by not mixing bytes and str.
Rafael Fonseca [Mon, 6 Feb 2017 16:07:28 +0000 (17:07 +0100)]
filetop: Fix TypeError by not mixing bytes and str.
When executing the filetop command tool, the following message was
generated:
Traceback (most recent call last):
File "/usr/share/bcc/tools/filetop", line 190, in <module>
name = name[:-3] + "..."
TypeError: can't concat bytes to str
Also, by decoding the bytes we print the strings without a leading "b'"
making the output more readable.
Brenden Blanco [Tue, 14 Feb 2017 08:19:18 +0000 (00:19 -0800)]
Merge pull request #871 from zhiyisun/patch
Add optional kernel flags for running networking examples in INSTALL.md
Brenden Blanco [Tue, 14 Feb 2017 08:18:43 +0000 (00:18 -0800)]
Merge branch 'master' into patch
Brenden Blanco [Tue, 14 Feb 2017 02:15:08 +0000 (18:15 -0800)]
Merge pull request #949 from ShelbyFrances/trace_enhancements
tools/trace accepts abspath arguments to -I (and some doc tweaks)
Brenden Blanco [Tue, 14 Feb 2017 02:14:20 +0000 (18:14 -0800)]
Merge pull request #956 from r4f4/fix-ucalls
Fix ucalls