Alexey Ivanov | cc01a9c | 2019-01-16 09:50:46 -0800 | [diff] [blame] | 1 | #!/usr/bin/python |
Brendan Gregg | ad341c9 | 2016-02-09 00:31:24 -0800 | [diff] [blame] | 2 | # @lint-avoid-python-3-compatibility-imports |
| 3 | # |
| 4 | # statsnoop Trace stat() syscalls. |
| 5 | # For Linux, uses BCC, eBPF. Embedded C. |
| 6 | # |
| 7 | # USAGE: statsnoop [-h] [-t] [-x] [-p PID] |
| 8 | # |
| 9 | # Copyright 2016 Netflix, Inc. |
| 10 | # Licensed under the Apache License, Version 2.0 (the "License") |
| 11 | # |
| 12 | # 08-Feb-2016 Brendan Gregg Created this. |
mcaleavya | e14f27f | 2016-02-17 22:12:44 +0000 | [diff] [blame] | 13 | # 17-Feb-2016 Allan McAleavy updated for BPF_PERF_OUTPUT |
Brendan Gregg | ad341c9 | 2016-02-09 00:31:24 -0800 | [diff] [blame] | 14 | |
| 15 | from __future__ import print_function |
| 16 | from bcc import BPF |
| 17 | import argparse |
| 18 | |
| 19 | # arguments |
| 20 | examples = """examples: |
| 21 | ./statsnoop # trace all stat() syscalls |
| 22 | ./statsnoop -t # include timestamps |
| 23 | ./statsnoop -x # only show failed stats |
| 24 | ./statsnoop -p 181 # only trace PID 181 |
| 25 | """ |
| 26 | parser = argparse.ArgumentParser( |
| 27 | description="Trace stat() syscalls", |
| 28 | formatter_class=argparse.RawDescriptionHelpFormatter, |
| 29 | epilog=examples) |
| 30 | parser.add_argument("-t", "--timestamp", action="store_true", |
| 31 | help="include timestamp on output") |
| 32 | parser.add_argument("-x", "--failed", action="store_true", |
| 33 | help="only show failed stats") |
| 34 | parser.add_argument("-p", "--pid", |
| 35 | help="trace this PID only") |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 36 | parser.add_argument("--ebpf", action="store_true", |
| 37 | help=argparse.SUPPRESS) |
Brendan Gregg | ad341c9 | 2016-02-09 00:31:24 -0800 | [diff] [blame] | 38 | args = parser.parse_args() |
| 39 | debug = 0 |
| 40 | |
| 41 | # define BPF program |
| 42 | bpf_text = """ |
| 43 | #include <uapi/linux/ptrace.h> |
mcaleavya | e14f27f | 2016-02-17 22:12:44 +0000 | [diff] [blame] | 44 | #include <uapi/linux/limits.h> |
| 45 | #include <linux/sched.h> |
| 46 | |
| 47 | struct val_t { |
mcaleavya | e14f27f | 2016-02-17 22:12:44 +0000 | [diff] [blame] | 48 | const char *fname; |
| 49 | }; |
| 50 | |
| 51 | struct data_t { |
| 52 | u32 pid; |
Brendan Gregg | f4ce31a | 2017-01-10 22:31:30 -0800 | [diff] [blame] | 53 | u64 ts_ns; |
mcaleavya | e14f27f | 2016-02-17 22:12:44 +0000 | [diff] [blame] | 54 | int ret; |
| 55 | char comm[TASK_COMM_LEN]; |
| 56 | char fname[NAME_MAX]; |
| 57 | }; |
Brendan Gregg | ad341c9 | 2016-02-09 00:31:24 -0800 | [diff] [blame] | 58 | |
mcaleavya | 1a7bebf | 2016-02-18 22:30:33 +0000 | [diff] [blame] | 59 | BPF_HASH(infotmp, u32, struct val_t); |
mcaleavya | e14f27f | 2016-02-17 22:12:44 +0000 | [diff] [blame] | 60 | BPF_PERF_OUTPUT(events); |
Brendan Gregg | ad341c9 | 2016-02-09 00:31:24 -0800 | [diff] [blame] | 61 | |
yonghong-song | 2da3426 | 2018-06-13 06:12:22 -0700 | [diff] [blame] | 62 | int syscall__entry(struct pt_regs *ctx, const char __user *filename) |
Brendan Gregg | ad341c9 | 2016-02-09 00:31:24 -0800 | [diff] [blame] | 63 | { |
mcaleavya | e14f27f | 2016-02-17 22:12:44 +0000 | [diff] [blame] | 64 | struct val_t val = {}; |
Hengqi Chen | dddda3b | 2021-05-08 09:15:25 +0800 | [diff] [blame] | 65 | u64 pid_tgid = bpf_get_current_pid_tgid(); |
| 66 | u32 pid = pid_tgid >> 32; |
| 67 | u32 tid = (u32)pid_tgid; |
Brendan Gregg | ad341c9 | 2016-02-09 00:31:24 -0800 | [diff] [blame] | 68 | |
| 69 | FILTER |
Brendan Gregg | f4ce31a | 2017-01-10 22:31:30 -0800 | [diff] [blame] | 70 | val.fname = filename; |
Hengqi Chen | dddda3b | 2021-05-08 09:15:25 +0800 | [diff] [blame] | 71 | infotmp.update(&tid, &val); |
Brendan Gregg | ad341c9 | 2016-02-09 00:31:24 -0800 | [diff] [blame] | 72 | |
| 73 | return 0; |
| 74 | }; |
| 75 | |
| 76 | int trace_return(struct pt_regs *ctx) |
| 77 | { |
Hengqi Chen | dddda3b | 2021-05-08 09:15:25 +0800 | [diff] [blame] | 78 | u64 pid_tgid = bpf_get_current_pid_tgid(); |
| 79 | u32 tid = (u32)pid_tgid; |
mcaleavya | e14f27f | 2016-02-17 22:12:44 +0000 | [diff] [blame] | 80 | struct val_t *valp; |
mcaleavya | e14f27f | 2016-02-17 22:12:44 +0000 | [diff] [blame] | 81 | |
Hengqi Chen | dddda3b | 2021-05-08 09:15:25 +0800 | [diff] [blame] | 82 | valp = infotmp.lookup(&tid); |
mcaleavya | e14f27f | 2016-02-17 22:12:44 +0000 | [diff] [blame] | 83 | if (valp == 0) { |
Brendan Gregg | ad341c9 | 2016-02-09 00:31:24 -0800 | [diff] [blame] | 84 | // missed entry |
| 85 | return 0; |
| 86 | } |
Brendan Gregg | f4ce31a | 2017-01-10 22:31:30 -0800 | [diff] [blame] | 87 | |
Hengqi Chen | dddda3b | 2021-05-08 09:15:25 +0800 | [diff] [blame] | 88 | struct data_t data = {.pid = pid_tgid >> 32}; |
Sumanth Korikkar | 023154c | 2020-04-20 05:54:57 -0500 | [diff] [blame] | 89 | bpf_probe_read_user(&data.fname, sizeof(data.fname), (void *)valp->fname); |
Brendan Gregg | f4ce31a | 2017-01-10 22:31:30 -0800 | [diff] [blame] | 90 | bpf_get_current_comm(&data.comm, sizeof(data.comm)); |
| 91 | data.ts_ns = bpf_ktime_get_ns(); |
Naveen N. Rao | 4afa96a | 2016-05-03 14:54:21 +0530 | [diff] [blame] | 92 | data.ret = PT_REGS_RC(ctx); |
Brendan Gregg | ad341c9 | 2016-02-09 00:31:24 -0800 | [diff] [blame] | 93 | |
mcaleavya | 1a7bebf | 2016-02-18 22:30:33 +0000 | [diff] [blame] | 94 | events.perf_submit(ctx, &data, sizeof(data)); |
Hengqi Chen | dddda3b | 2021-05-08 09:15:25 +0800 | [diff] [blame] | 95 | infotmp.delete(&tid); |
Brendan Gregg | ad341c9 | 2016-02-09 00:31:24 -0800 | [diff] [blame] | 96 | |
| 97 | return 0; |
| 98 | } |
| 99 | """ |
| 100 | if args.pid: |
| 101 | bpf_text = bpf_text.replace('FILTER', |
| 102 | 'if (pid != %s) { return 0; }' % args.pid) |
| 103 | else: |
| 104 | bpf_text = bpf_text.replace('FILTER', '') |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 105 | if debug or args.ebpf: |
Brendan Gregg | ad341c9 | 2016-02-09 00:31:24 -0800 | [diff] [blame] | 106 | print(bpf_text) |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 107 | if args.ebpf: |
| 108 | exit() |
Brendan Gregg | ad341c9 | 2016-02-09 00:31:24 -0800 | [diff] [blame] | 109 | |
| 110 | # initialize BPF |
| 111 | b = BPF(text=bpf_text) |
Sandipan Das | 16523a3 | 2017-10-05 12:13:12 +0530 | [diff] [blame] | 112 | |
| 113 | # for POSIX compliance, all architectures implement these |
| 114 | # system calls but the name of the actual entry point may |
| 115 | # be different for which we must check if the entry points |
| 116 | # actually exist before attaching the probes |
Yonghong Song | 6433569 | 2018-04-25 00:40:13 -0700 | [diff] [blame] | 117 | syscall_fnname = b.get_syscall_fnname("stat") |
| 118 | if BPF.ksymname(syscall_fnname) != -1: |
yonghong-song | 2da3426 | 2018-06-13 06:12:22 -0700 | [diff] [blame] | 119 | b.attach_kprobe(event=syscall_fnname, fn_name="syscall__entry") |
Yonghong Song | 6433569 | 2018-04-25 00:40:13 -0700 | [diff] [blame] | 120 | b.attach_kretprobe(event=syscall_fnname, fn_name="trace_return") |
Sandipan Das | 16523a3 | 2017-10-05 12:13:12 +0530 | [diff] [blame] | 121 | |
Yonghong Song | 6433569 | 2018-04-25 00:40:13 -0700 | [diff] [blame] | 122 | syscall_fnname = b.get_syscall_fnname("statfs") |
| 123 | if BPF.ksymname(syscall_fnname) != -1: |
yonghong-song | 2da3426 | 2018-06-13 06:12:22 -0700 | [diff] [blame] | 124 | b.attach_kprobe(event=syscall_fnname, fn_name="syscall__entry") |
Yonghong Song | 6433569 | 2018-04-25 00:40:13 -0700 | [diff] [blame] | 125 | b.attach_kretprobe(event=syscall_fnname, fn_name="trace_return") |
Sandipan Das | 16523a3 | 2017-10-05 12:13:12 +0530 | [diff] [blame] | 126 | |
Yonghong Song | 6433569 | 2018-04-25 00:40:13 -0700 | [diff] [blame] | 127 | syscall_fnname = b.get_syscall_fnname("newstat") |
| 128 | if BPF.ksymname(syscall_fnname) != -1: |
yonghong-song | 2da3426 | 2018-06-13 06:12:22 -0700 | [diff] [blame] | 129 | b.attach_kprobe(event=syscall_fnname, fn_name="syscall__entry") |
Yonghong Song | 6433569 | 2018-04-25 00:40:13 -0700 | [diff] [blame] | 130 | b.attach_kretprobe(event=syscall_fnname, fn_name="trace_return") |
Brendan Gregg | ad341c9 | 2016-02-09 00:31:24 -0800 | [diff] [blame] | 131 | |
mcaleavya | e14f27f | 2016-02-17 22:12:44 +0000 | [diff] [blame] | 132 | start_ts = 0 |
| 133 | prev_ts = 0 |
| 134 | delta = 0 |
| 135 | |
Brendan Gregg | ad341c9 | 2016-02-09 00:31:24 -0800 | [diff] [blame] | 136 | # header |
| 137 | if args.timestamp: |
| 138 | print("%-14s" % ("TIME(s)"), end="") |
Hengqi Chen | dddda3b | 2021-05-08 09:15:25 +0800 | [diff] [blame] | 139 | print("%-7s %-16s %4s %3s %s" % ("PID", "COMM", "FD", "ERR", "PATH")) |
Brendan Gregg | ad341c9 | 2016-02-09 00:31:24 -0800 | [diff] [blame] | 140 | |
mcaleavya | e14f27f | 2016-02-17 22:12:44 +0000 | [diff] [blame] | 141 | # process event |
| 142 | def print_event(cpu, data, size): |
Xiaozhou Liu | 51d62d3 | 2019-02-15 13:03:05 +0800 | [diff] [blame] | 143 | event = b["events"].event(data) |
mcaleavya | e14f27f | 2016-02-17 22:12:44 +0000 | [diff] [blame] | 144 | global start_ts |
| 145 | global prev_ts |
| 146 | global delta |
| 147 | global cont |
Brendan Gregg | ad341c9 | 2016-02-09 00:31:24 -0800 | [diff] [blame] | 148 | |
| 149 | # split return value into FD and errno columns |
mcaleavya | e14f27f | 2016-02-17 22:12:44 +0000 | [diff] [blame] | 150 | if event.ret >= 0: |
Hengqi Chen | dddda3b | 2021-05-08 09:15:25 +0800 | [diff] [blame] | 151 | if args.failed: |
| 152 | return |
mcaleavya | e14f27f | 2016-02-17 22:12:44 +0000 | [diff] [blame] | 153 | fd_s = event.ret |
Brendan Gregg | ad341c9 | 2016-02-09 00:31:24 -0800 | [diff] [blame] | 154 | err = 0 |
| 155 | else: |
mcaleavya | e14f27f | 2016-02-17 22:12:44 +0000 | [diff] [blame] | 156 | fd_s = -1 |
| 157 | err = - event.ret |
Brendan Gregg | ad341c9 | 2016-02-09 00:31:24 -0800 | [diff] [blame] | 158 | |
mcaleavya | e14f27f | 2016-02-17 22:12:44 +0000 | [diff] [blame] | 159 | if start_ts == 0: |
Brendan Gregg | f4ce31a | 2017-01-10 22:31:30 -0800 | [diff] [blame] | 160 | start_ts = event.ts_ns |
mcaleavya | e14f27f | 2016-02-17 22:12:44 +0000 | [diff] [blame] | 161 | |
Brendan Gregg | ad341c9 | 2016-02-09 00:31:24 -0800 | [diff] [blame] | 162 | if args.timestamp: |
Brendan Gregg | f4ce31a | 2017-01-10 22:31:30 -0800 | [diff] [blame] | 163 | print("%-14.9f" % (float(event.ts_ns - start_ts) / 1000000000), end="") |
mcaleavya | e14f27f | 2016-02-17 22:12:44 +0000 | [diff] [blame] | 164 | |
Hengqi Chen | dddda3b | 2021-05-08 09:15:25 +0800 | [diff] [blame] | 165 | print("%-7d %-16s %4d %3d %s" % (event.pid, |
jeromemarchand | b96ebcd | 2018-10-10 01:58:15 +0200 | [diff] [blame] | 166 | event.comm.decode('utf-8', 'replace'), fd_s, err, |
| 167 | event.fname.decode('utf-8', 'replace'))) |
mcaleavya | e14f27f | 2016-02-17 22:12:44 +0000 | [diff] [blame] | 168 | |
mcaleavya | e14f27f | 2016-02-17 22:12:44 +0000 | [diff] [blame] | 169 | # loop with callback to print_event |
Mark Drayton | 5f5687e | 2017-02-20 18:13:03 +0000 | [diff] [blame] | 170 | b["events"].open_perf_buffer(print_event, page_cnt=64) |
mcaleavya | e14f27f | 2016-02-17 22:12:44 +0000 | [diff] [blame] | 171 | while 1: |
Jerome Marchand | 5167127 | 2018-12-19 01:57:24 +0100 | [diff] [blame] | 172 | try: |
| 173 | b.perf_buffer_poll() |
| 174 | except KeyboardInterrupt: |
| 175 | exit() |