Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 1 | #!/usr/bin/python |
| 2 | # @lint-avoid-python-3-compatibility-imports |
| 3 | # |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 4 | # ucalls Summarize method calls in high-level languages and/or system calls. |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 5 | # For Linux, uses BCC, eBPF. |
| 6 | # |
Sasha Goldshtein | cfb5ee7 | 2017-02-08 14:32:51 -0500 | [diff] [blame] | 7 | # USAGE: ucalls [-l {java,python,ruby,php}] [-h] [-T TOP] [-L] [-S] [-v] [-m] |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 8 | # pid [interval] |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 9 | # |
| 10 | # Copyright 2016 Sasha Goldshtein |
| 11 | # Licensed under the Apache License, Version 2.0 (the "License") |
| 12 | # |
| 13 | # 19-Oct-2016 Sasha Goldshtein Created this. |
| 14 | |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 15 | from __future__ import print_function |
| 16 | import argparse |
| 17 | from bcc import BPF, USDT |
| 18 | from time import sleep |
| 19 | |
| 20 | examples = """examples: |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 21 | ./ucalls -l java 185 # trace Java calls and print statistics on ^C |
| 22 | ./ucalls -l python 2020 1 # trace Python calls and print every second |
| 23 | ./ucalls -l java 185 -S # trace Java calls and syscalls |
| 24 | ./ucalls 6712 -S # trace only syscall counts |
| 25 | ./ucalls -l ruby 1344 -T 10 # trace top 10 Ruby method calls |
| 26 | ./ucalls -l ruby 1344 -L # trace Ruby calls including latency |
Sasha Goldshtein | cfb5ee7 | 2017-02-08 14:32:51 -0500 | [diff] [blame] | 27 | ./ucalls -l php 443 -LS # trace PHP calls and syscalls with latency |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 28 | ./ucalls -l python 2020 -mL # trace Python calls including latency in ms |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 29 | """ |
| 30 | parser = argparse.ArgumentParser( |
| 31 | description="Summarize method calls in high-level languages.", |
| 32 | formatter_class=argparse.RawDescriptionHelpFormatter, |
| 33 | epilog=examples) |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 34 | parser.add_argument("pid", type=int, help="process id to attach to") |
| 35 | parser.add_argument("interval", type=int, nargs='?', |
| 36 | help="print every specified number of seconds") |
Sasha Goldshtein | cfb5ee7 | 2017-02-08 14:32:51 -0500 | [diff] [blame] | 37 | parser.add_argument("-l", "--language", |
| 38 | choices=["java", "python", "ruby", "php"], |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 39 | help="language to trace (if none, trace syscalls only)") |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 40 | parser.add_argument("-T", "--top", type=int, |
| 41 | help="number of most frequent/slow calls to print") |
| 42 | parser.add_argument("-L", "--latency", action="store_true", |
| 43 | help="record method latency from enter to exit (except recursive calls)") |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 44 | parser.add_argument("-S", "--syscalls", action="store_true", |
| 45 | help="record syscall latency (adds overhead)") |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 46 | parser.add_argument("-v", "--verbose", action="store_true", |
| 47 | help="verbose mode: print the BPF program (for debugging purposes)") |
| 48 | parser.add_argument("-m", "--milliseconds", action="store_true", |
| 49 | help="report times in milliseconds (default is microseconds)") |
| 50 | args = parser.parse_args() |
| 51 | |
| 52 | # We assume that the entry and return probes have the same arguments. This is |
Sasha Goldshtein | cfb5ee7 | 2017-02-08 14:32:51 -0500 | [diff] [blame] | 53 | # the case for Java, Python, Ruby, and PHP. If there's a language where it's |
| 54 | # not the case, we will need to build a custom correlator from entry to exit. |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 55 | if args.language == "java": |
| 56 | # TODO for JVM entries, we actually have the real length of the class |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 57 | # and method strings in arg3 and arg5 respectively, so we can insert |
| 58 | # the null terminator in its proper position. |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 59 | entry_probe = "method__entry" |
| 60 | return_probe = "method__return" |
| 61 | read_class = "bpf_usdt_readarg(2, ctx, &clazz);" |
| 62 | read_method = "bpf_usdt_readarg(4, ctx, &method);" |
| 63 | elif args.language == "python": |
| 64 | entry_probe = "function__entry" |
| 65 | return_probe = "function__return" |
| 66 | read_class = "bpf_usdt_readarg(1, ctx, &clazz);" # filename really |
| 67 | read_method = "bpf_usdt_readarg(2, ctx, &method);" |
| 68 | elif args.language == "ruby": |
Sasha Goldshtein | 6e5c621 | 2016-10-25 04:30:54 -0700 | [diff] [blame] | 69 | # TODO Also probe cmethod__entry and cmethod__return with same arguments |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 70 | entry_probe = "method__entry" |
| 71 | return_probe = "method__return" |
| 72 | read_class = "bpf_usdt_readarg(1, ctx, &clazz);" |
| 73 | read_method = "bpf_usdt_readarg(2, ctx, &method);" |
Sasha Goldshtein | cfb5ee7 | 2017-02-08 14:32:51 -0500 | [diff] [blame] | 74 | elif args.language == "php": |
| 75 | entry_probe = "function__entry" |
| 76 | return_probe = "function__return" |
| 77 | read_class = "bpf_usdt_readarg(4, ctx, &clazz);" |
| 78 | read_method = "bpf_usdt_readarg(1, ctx, &method);" |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 79 | elif not args.language: |
| 80 | if not args.syscalls: |
| 81 | print("Nothing to do; use -S to trace syscalls.") |
| 82 | exit(1) |
| 83 | entry_probe, return_probe, read_class, read_method = ("", "", "", "") |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 84 | |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 85 | program = """ |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 86 | #include <linux/ptrace.h> |
| 87 | |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 88 | #define MAX_STRING_LENGTH 80 |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 89 | DEFINE_NOLANG |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 90 | DEFINE_LATENCY |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 91 | DEFINE_SYSCALLS |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 92 | |
| 93 | struct method_t { |
| 94 | char clazz[MAX_STRING_LENGTH]; |
| 95 | char method[MAX_STRING_LENGTH]; |
| 96 | }; |
| 97 | struct entry_t { |
| 98 | u64 pid; |
| 99 | struct method_t method; |
| 100 | }; |
| 101 | struct info_t { |
| 102 | u64 num_calls; |
| 103 | u64 total_ns; |
| 104 | }; |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 105 | struct syscall_entry_t { |
| 106 | u64 timestamp; |
| 107 | u64 ip; |
| 108 | }; |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 109 | |
| 110 | #ifndef LATENCY |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 111 | BPF_HASH(counts, struct method_t, u64); // number of calls |
| 112 | #ifdef SYSCALLS |
| 113 | BPF_HASH(syscounts, u64, u64); // number of calls per IP |
| 114 | #endif // SYSCALLS |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 115 | #else |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 116 | BPF_HASH(times, struct method_t, struct info_t); |
| 117 | BPF_HASH(entry, struct entry_t, u64); // timestamp at entry |
| 118 | #ifdef SYSCALLS |
| 119 | BPF_HASH(systimes, u64, struct info_t); // latency per IP |
| 120 | BPF_HASH(sysentry, u64, struct syscall_entry_t); // ts + IP at entry |
| 121 | #endif // SYSCALLS |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 122 | #endif |
| 123 | |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 124 | #ifndef NOLANG |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 125 | int trace_entry(struct pt_regs *ctx) { |
| 126 | u64 clazz = 0, method = 0, val = 0; |
| 127 | u64 *valp; |
| 128 | struct entry_t data = {0}; |
| 129 | #ifdef LATENCY |
| 130 | u64 timestamp = bpf_ktime_get_ns(); |
| 131 | data.pid = bpf_get_current_pid_tgid(); |
| 132 | #endif |
| 133 | READ_CLASS |
| 134 | READ_METHOD |
| 135 | bpf_probe_read(&data.method.clazz, sizeof(data.method.clazz), |
| 136 | (void *)clazz); |
| 137 | bpf_probe_read(&data.method.method, sizeof(data.method.method), |
| 138 | (void *)method); |
| 139 | #ifndef LATENCY |
| 140 | valp = counts.lookup_or_init(&data.method, &val); |
| 141 | ++(*valp); |
| 142 | #endif |
| 143 | #ifdef LATENCY |
| 144 | entry.update(&data, ×tamp); |
| 145 | #endif |
| 146 | return 0; |
| 147 | } |
| 148 | |
| 149 | #ifdef LATENCY |
| 150 | int trace_return(struct pt_regs *ctx) { |
| 151 | u64 *entry_timestamp, clazz = 0, method = 0; |
| 152 | struct info_t *info, zero = {}; |
| 153 | struct entry_t data = {}; |
| 154 | data.pid = bpf_get_current_pid_tgid(); |
| 155 | READ_CLASS |
| 156 | READ_METHOD |
| 157 | bpf_probe_read(&data.method.clazz, sizeof(data.method.clazz), |
| 158 | (void *)clazz); |
| 159 | bpf_probe_read(&data.method.method, sizeof(data.method.method), |
| 160 | (void *)method); |
| 161 | entry_timestamp = entry.lookup(&data); |
| 162 | if (!entry_timestamp) { |
| 163 | return 0; // missed the entry event |
| 164 | } |
| 165 | info = times.lookup_or_init(&data.method, &zero); |
| 166 | info->num_calls += 1; |
| 167 | info->total_ns += bpf_ktime_get_ns() - *entry_timestamp; |
| 168 | entry.delete(&data); |
| 169 | return 0; |
| 170 | } |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 171 | #endif // LATENCY |
| 172 | #endif // NOLANG |
| 173 | |
| 174 | #ifdef SYSCALLS |
| 175 | int syscall_entry(struct pt_regs *ctx) { |
| 176 | u64 pid = bpf_get_current_pid_tgid(); |
| 177 | u64 *valp, ip = ctx->ip, val = 0; |
| 178 | PID_FILTER |
| 179 | #ifdef LATENCY |
| 180 | struct syscall_entry_t data = {}; |
| 181 | data.timestamp = bpf_ktime_get_ns(); |
| 182 | data.ip = ip; |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 183 | #endif |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 184 | #ifndef LATENCY |
| 185 | valp = syscounts.lookup_or_init(&ip, &val); |
| 186 | ++(*valp); |
| 187 | #endif |
| 188 | #ifdef LATENCY |
| 189 | sysentry.update(&pid, &data); |
| 190 | #endif |
| 191 | return 0; |
| 192 | } |
| 193 | |
| 194 | #ifdef LATENCY |
| 195 | int syscall_return(struct pt_regs *ctx) { |
| 196 | struct syscall_entry_t *e; |
| 197 | struct info_t *info, zero = {}; |
| 198 | u64 pid = bpf_get_current_pid_tgid(), ip; |
| 199 | PID_FILTER |
| 200 | e = sysentry.lookup(&pid); |
| 201 | if (!e) { |
| 202 | return 0; // missed the entry event |
| 203 | } |
| 204 | ip = e->ip; |
| 205 | info = systimes.lookup_or_init(&ip, &zero); |
| 206 | info->num_calls += 1; |
| 207 | info->total_ns += bpf_ktime_get_ns() - e->timestamp; |
| 208 | sysentry.delete(&pid); |
| 209 | return 0; |
| 210 | } |
| 211 | #endif // LATENCY |
| 212 | #endif // SYSCALLS |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 213 | """.replace("READ_CLASS", read_class) \ |
| 214 | .replace("READ_METHOD", read_method) \ |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 215 | .replace("PID_FILTER", "if ((pid >> 32) != %d) { return 0; }" % args.pid) \ |
| 216 | .replace("DEFINE_NOLANG", "#define NOLANG" if not args.language else "") \ |
| 217 | .replace("DEFINE_LATENCY", "#define LATENCY" if args.latency else "") \ |
| 218 | .replace("DEFINE_SYSCALLS", "#define SYSCALLS" if args.syscalls else "") |
| 219 | |
| 220 | if args.language: |
| 221 | usdt = USDT(pid=args.pid) |
Sasha Goldshtein | dc3a57c | 2017-02-08 16:02:11 -0500 | [diff] [blame] | 222 | usdt.enable_probe_or_bail(entry_probe, "trace_entry") |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 223 | if args.latency: |
Sasha Goldshtein | dc3a57c | 2017-02-08 16:02:11 -0500 | [diff] [blame] | 224 | usdt.enable_probe_or_bail(return_probe, "trace_return") |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 225 | else: |
| 226 | usdt = None |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 227 | |
| 228 | if args.verbose: |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 229 | if usdt: |
| 230 | print(usdt.get_text()) |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 231 | print(program) |
| 232 | |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 233 | bpf = BPF(text=program, usdt_contexts=[usdt] if usdt else []) |
| 234 | if args.syscalls: |
| 235 | syscall_regex = "^[Ss]y[Ss]_.*" |
| 236 | bpf.attach_kprobe(event_re=syscall_regex, fn_name="syscall_entry") |
| 237 | if args.latency: |
| 238 | bpf.attach_kretprobe(event_re=syscall_regex, fn_name="syscall_return") |
| 239 | print("Attached %d kernel probes for syscall tracing." % |
| 240 | bpf.num_open_kprobes()) |
| 241 | |
| 242 | def get_data(): |
| 243 | # Will be empty when no language was specified for tracing |
| 244 | if args.latency: |
Rafael Fonseca | 0d66906 | 2017-02-13 15:52:04 +0100 | [diff] [blame] | 245 | data = list(map(lambda kv: (kv[0].clazz + "." + kv[0].method, |
| 246 | (kv[1].num_calls, kv[1].total_ns)), |
Rafael Fonseca | 42900ae | 2017-02-13 15:46:54 +0100 | [diff] [blame] | 247 | bpf["times"].items())) |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 248 | else: |
Rafael Fonseca | 0d66906 | 2017-02-13 15:52:04 +0100 | [diff] [blame] | 249 | data = list(map(lambda kv: (kv[0].clazz + "." + kv[0].method, |
| 250 | (kv[1].value, 0)), |
Rafael Fonseca | 42900ae | 2017-02-13 15:46:54 +0100 | [diff] [blame] | 251 | bpf["counts"].items())) |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 252 | |
| 253 | if args.syscalls: |
| 254 | if args.latency: |
Rafael Fonseca | 0d66906 | 2017-02-13 15:52:04 +0100 | [diff] [blame] | 255 | syscalls = map(lambda kv: (bpf.ksym(kv[0].value), |
| 256 | (kv[1].num_calls, kv[1].total_ns)), |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 257 | bpf["systimes"].items()) |
| 258 | data.extend(syscalls) |
| 259 | else: |
Paul Chaignon | 956ca1c | 2017-03-04 20:07:56 +0100 | [diff] [blame] | 260 | syscalls = map(lambda kv: (bpf.ksym(kv[0].value), |
| 261 | (kv[1].value, 0)), |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 262 | bpf["syscounts"].items()) |
| 263 | data.extend(syscalls) |
| 264 | |
Rafael Fonseca | 0d66906 | 2017-02-13 15:52:04 +0100 | [diff] [blame] | 265 | return sorted(data, key=lambda kv: kv[1][1 if args.latency else 0]) |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 266 | |
| 267 | def clear_data(): |
| 268 | if args.latency: |
| 269 | bpf["times"].clear() |
| 270 | else: |
| 271 | bpf["counts"].clear() |
| 272 | |
| 273 | if args.syscalls: |
| 274 | if args.latency: |
| 275 | bpf["systimes"].clear() |
| 276 | else: |
| 277 | bpf["syscounts"].clear() |
| 278 | |
| 279 | exit_signaled = False |
| 280 | print("Tracing calls in process %d (language: %s)... Ctrl-C to quit." % |
| 281 | (args.pid, args.language or "none")) |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 282 | while True: |
| 283 | try: |
| 284 | sleep(args.interval or 99999999) |
| 285 | except KeyboardInterrupt: |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 286 | exit_signaled = True |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 287 | print() |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 288 | data = get_data() # [(function, (num calls, latency in ns))] |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 289 | if args.latency: |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 290 | time_col = "TIME (ms)" if args.milliseconds else "TIME (us)" |
| 291 | print("%-50s %8s %8s" % ("METHOD", "# CALLS", time_col)) |
| 292 | else: |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 293 | print("%-50s %8s" % ("METHOD", "# CALLS")) |
| 294 | if args.top: |
| 295 | data = data[-args.top:] |
| 296 | for key, value in data: |
| 297 | if args.latency: |
Paul Chaignon | 956ca1c | 2017-03-04 20:07:56 +0100 | [diff] [blame] | 298 | time = value[1] / 1000000.0 if args.milliseconds else \ |
| 299 | value[1] / 1000.0 |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 300 | print("%-50s %8d %6.2f" % (key, value[0], time)) |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 301 | else: |
Sasha Goldshtein | a245c79 | 2016-10-25 02:18:35 -0700 | [diff] [blame] | 302 | print("%-50s %8d" % (key, value[0])) |
| 303 | if args.interval and not exit_signaled: |
| 304 | clear_data() |
| 305 | else: |
| 306 | if args.syscalls: |
| 307 | print("Detaching kernel probes, please wait...") |
Sasha Goldshtein | c13d14f | 2016-10-17 04:13:48 -0700 | [diff] [blame] | 308 | exit() |