| .TH funccount 8 "2015-08-18" "USER COMMANDS" |
| .SH NAME |
| funccount \- Count kernel function calls matching a pattern. Uses Linux eBPF/bcc. |
| .SH SYNOPSIS |
| .B funccount [\-h] [\-p PID] [\-i INTERVAL] [\-T] [\-r] pattern |
| .SH DESCRIPTION |
| This tool is a quick way to determine which kernel functions are being called, |
| and at what rate. It uses in-kernel eBPF maps to count function calls. |
| |
| WARNING: This uses dynamic tracing of (what can be many) kernel functions, an |
| activity that has had issues on some kernel versions (risk of panics or |
| freezes). Test, and know what you are doing, before use. |
| |
| Since this uses BPF, only the root user can use this tool. |
| .SH REQUIREMENTS |
| CONFIG_BPF and bcc. |
| .SH OPTIONS |
| pattern |
| Search pattern. Supports "*" wildcards. See EXAMPLES. You can also use \-r for regular expressions. |
| .TP |
| \-h |
| Print usage message. |
| .TP |
| \-p PID |
| Trace this process ID only. |
| .TP |
| \-i INTERVAL |
| Print output every interval seconds. |
| .TP |
| \-T |
| Include timestamps on output. |
| .TP |
| \-r |
| Use regular expressions for the search pattern. |
| .SH EXAMPLES |
| .TP |
| Count kernel functions beginning with "vfs_", until Ctrl-C is hit: |
| # |
| .B funccount 'vfs_*' |
| .TP |
| Count kernel functions beginning with "tcp_send", until Ctrl-C is hit: |
| # |
| .B funccount 'tcp_send*' |
| .TP |
| Print kernel functions beginning with "vfs_", every second: |
| # |
| .B funccount \-i 1 'vfs_*' |
| .TP |
| Match kernel functions beginning with "vfs_", using regular expressions: |
| # |
| .B funccount \-r '^vfs_.*' |
| .TP |
| Count vfs calls for process ID 181 only: |
| # |
| .B funccount \-p 181 'vfs_*' |
| .SH FIELDS |
| .TP |
| ADDR |
| Address of the instruction pointer that was traced (only useful if the FUNC column is suspicious and you would like to double check the translation). |
| .TP |
| FUNC |
| Kernel function name |
| .TP |
| COUNT |
| Number of calls while tracing |
| .SH OVERHEAD |
| This traces kernel functions and maintains in-kernel counts, which |
| are asynchronously copied to user-space. While the rate of kernel calls |
| be very high (>1M/sec), this is a relatively efficient way to trace these |
| events, and so the overhead is expected to be small for normal workloads. |
| Measure in a test environment before use. |
| .SH SOURCE |
| This is from bcc. |
| .IP |
| https://github.com/iovisor/bcc |
| .PP |
| Also look in the bcc distribution for a companion _examples.txt file containing |
| example usage, output, and commentary for this tool. |
| .SH OS |
| Linux |
| .SH STABILITY |
| Unstable - in development. |
| .SH AUTHOR |
| Brendan Gregg |
| .SH SEE ALSO |
| vfscount(8) |