| Brendan Gregg | 3f95637 | 2020-09-16 14:32:16 -0700 | [diff] [blame] | 1 | Demonstrations of threadsnoop, the Linux BCC/eBPF version. |
| 2 | |
| 3 | |
| 4 | Tracing new threads via phtread_create(): |
| 5 | |
| 6 | # ./threadsnoop |
| 7 | Attaching 2 probes... |
| 8 | TIME(ms) PID COMM FUNC |
| 9 | 1938 28549 dockerd threadentry |
| 10 | 1939 28549 dockerd threadentry |
| 11 | 1939 28549 dockerd threadentry |
| 12 | 1940 28549 dockerd threadentry |
| 13 | 1949 28549 dockerd threadentry |
| 14 | 1958 28549 dockerd threadentry |
| 15 | 1939 28549 dockerd threadentry |
| 16 | 1950 28549 dockerd threadentry |
| 17 | 2013 28579 docker-containe 0x562f30f2e710L |
| 18 | 2036 28549 dockerd threadentry |
| 19 | 2083 28579 docker-containe 0x562f30f2e710L |
| 20 | 2116 629 systemd-journal 0x7fb7114955c0L |
| 21 | 2116 629 systemd-journal 0x7fb7114955c0L |
| 22 | [...] |
| 23 | |
| 24 | The output shows a dockerd process creating several threads with the start |
| 25 | routine threadentry(), and docker-containe (truncated) and systemd-journal |
| 26 | also starting threads: in their cases, the function had no symbol information |
| 27 | available, so their addresses are printed in hex. |