| Demonstrations of filelife, the Linux eBPF/bcc version. |
| |
| |
| filelife traces short-lived files: those that have been created and then |
| deleted while tracing. For example: |
| |
| # ./filelife |
| TIME PID COMM AGE(s) FILE |
| 05:57:59 8556 gcc 0.04 ccCB5EDe.s |
| 05:57:59 8560 rm 0.02 .entry_64.o.d |
| 05:57:59 8563 gcc 0.02 cc5UFHXf.s |
| 05:57:59 8567 rm 0.01 .thunk_64.o.d |
| 05:57:59 8578 rm 0.02 .syscall_64.o.d |
| 05:58:00 8589 rm 0.03 .common.o.d |
| 05:58:00 8596 rm 0.01 .8592.tmp |
| 05:58:00 8601 rm 0.01 .8597.tmp |
| 05:58:00 8606 rm 0.01 .8602.tmp |
| 05:58:00 8639 rm 0.02 .vma.o.d |
| 05:58:00 8650 rm 0.02 .vdso32-setup.o.d |
| 05:58:00 8656 rm 0.00 .vdso.lds.d |
| 05:58:00 8659 gcc 0.01 ccveeJAz.s |
| 05:58:00 8663 rm 0.01 .vdso-note.o.d |
| 05:58:00 8674 rm 0.02 .vclock_gettime.o.d |
| 05:58:01 8684 rm 0.01 .vgetcpu.o.d |
| 05:58:01 8690 collect2 0.00 ccvKMxdm.ld |
| |
| This has caught short-lived files that were created during a Linux kernel |
| build. The PID shows the process ID that finally deleted the file, and COMM |
| is its process name. The AGE(s) column shows the age of the file, in seconds, |
| when it was deleted. These are all short-lived, and existed for less than |
| one tenth of a second. |
| |
| Creating, populating, and then deleting files as part of another process can |
| be an inefficient method of inter-process communication. It can cause disk I/O |
| as files are closed and their file descriptors flushed, only later to be |
| deleted. As such, short-lived files can be a target of performance |
| optimizations. |
| |
| USAGE message: |
| |
| # ./filelife -h |
| usage: filelife [-h] [-p PID] |
| |
| Trace stat() syscalls |
| |
| optional arguments: |
| -h, --help show this help message and exit |
| -p PID, --pid PID trace this PID only |
| |
| examples: |
| ./filelife # trace all stat() syscalls |
| ./filelife -p 181 # only trace PID 181 |