Alexey Ivanov | cc01a9c | 2019-01-16 09:50:46 -0800 | [diff] [blame] | 1 | #!/usr/bin/python |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 2 | # @lint-avoid-python-3-compatibility-imports |
| 3 | # |
| 4 | # filetop file reads and writes by process. |
| 5 | # For Linux, uses BCC, eBPF. |
| 6 | # |
| 7 | # USAGE: filetop.py [-h] [-C] [-r MAXROWS] [interval] [count] |
| 8 | # |
| 9 | # This uses in-kernel eBPF maps to store per process summaries for efficiency. |
| 10 | # |
| 11 | # Copyright 2016 Netflix, Inc. |
| 12 | # Licensed under the Apache License, Version 2.0 (the "License") |
| 13 | # |
| 14 | # 06-Feb-2016 Brendan Gregg Created this. |
| 15 | |
| 16 | from __future__ import print_function |
| 17 | from bcc import BPF |
| 18 | from time import sleep, strftime |
| 19 | import argparse |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 20 | from subprocess import call |
| 21 | |
| 22 | # arguments |
| 23 | examples = """examples: |
| 24 | ./filetop # file I/O top, 1 second refresh |
| 25 | ./filetop -C # don't clear the screen |
| 26 | ./filetop -p 181 # PID 181 only |
| 27 | ./filetop 5 # 5 second summaries |
| 28 | ./filetop 5 10 # 5 second summaries, 10 times only |
| 29 | """ |
| 30 | parser = argparse.ArgumentParser( |
| 31 | description="File reads and writes by process", |
| 32 | formatter_class=argparse.RawDescriptionHelpFormatter, |
| 33 | epilog=examples) |
Mark Drayton | 7434731 | 2016-08-25 20:46:35 +0100 | [diff] [blame] | 34 | parser.add_argument("-a", "--all-files", action="store_true", |
| 35 | help="include non-regular file types (sockets, FIFOs, etc)") |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 36 | parser.add_argument("-C", "--noclear", action="store_true", |
| 37 | help="don't clear the screen") |
| 38 | parser.add_argument("-r", "--maxrows", default=20, |
| 39 | help="maximum rows to print, default 20") |
Joel Fernandes (Google) | c2b371d | 2019-03-08 11:39:42 -0500 | [diff] [blame] | 40 | parser.add_argument("-s", "--sort", default="all", |
| 41 | choices=["all", "reads", "writes", "rbytes", "wbytes"], |
Felix Geisendörfer | 3106a82 | 2019-12-12 16:41:09 +0800 | [diff] [blame] | 42 | help="sort column, default all") |
Mark Drayton | 7434731 | 2016-08-25 20:46:35 +0100 | [diff] [blame] | 43 | parser.add_argument("-p", "--pid", type=int, metavar="PID", dest="tgid", |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 44 | help="trace this PID only") |
| 45 | parser.add_argument("interval", nargs="?", default=1, |
| 46 | help="output interval, in seconds") |
| 47 | parser.add_argument("count", nargs="?", default=99999999, |
| 48 | help="number of outputs") |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 49 | parser.add_argument("--ebpf", action="store_true", |
| 50 | help=argparse.SUPPRESS) |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 51 | args = parser.parse_args() |
| 52 | interval = int(args.interval) |
| 53 | countdown = int(args.count) |
| 54 | maxrows = int(args.maxrows) |
| 55 | clear = not int(args.noclear) |
| 56 | debug = 0 |
| 57 | |
| 58 | # linux stats |
| 59 | loadavg = "/proc/loadavg" |
| 60 | |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 61 | # define BPF program |
| 62 | bpf_text = """ |
| 63 | #include <uapi/linux/ptrace.h> |
| 64 | #include <linux/blkdev.h> |
| 65 | |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 66 | // the key for the output summary |
| 67 | struct info_t { |
Hengqi Chen | d567347 | 2021-07-28 23:49:11 +0800 | [diff] [blame] | 68 | unsigned long inode; |
| 69 | dev_t dev; |
Hengqi Chen | 7db3488 | 2022-01-30 11:14:57 +0800 | [diff] [blame] | 70 | dev_t rdev; |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 71 | u32 pid; |
Mark Drayton | 7434731 | 2016-08-25 20:46:35 +0100 | [diff] [blame] | 72 | u32 name_len; |
| 73 | char comm[TASK_COMM_LEN]; |
| 74 | // de->d_name.name may point to de->d_iname so limit len accordingly |
| 75 | char name[DNAME_INLINE_LEN]; |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 76 | char type; |
| 77 | }; |
| 78 | |
| 79 | // the value of the output summary |
| 80 | struct val_t { |
| 81 | u64 reads; |
| 82 | u64 writes; |
| 83 | u64 rbytes; |
| 84 | u64 wbytes; |
| 85 | }; |
| 86 | |
| 87 | BPF_HASH(counts, struct info_t, struct val_t); |
| 88 | |
| 89 | static int do_entry(struct pt_regs *ctx, struct file *file, |
| 90 | char __user *buf, size_t count, int is_read) |
| 91 | { |
Mark Drayton | 7434731 | 2016-08-25 20:46:35 +0100 | [diff] [blame] | 92 | u32 tgid = bpf_get_current_pid_tgid() >> 32; |
| 93 | if (TGID_FILTER) |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 94 | return 0; |
| 95 | |
Mark Drayton | 7434731 | 2016-08-25 20:46:35 +0100 | [diff] [blame] | 96 | u32 pid = bpf_get_current_pid_tgid(); |
| 97 | |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 98 | // skip I/O lacking a filename |
| 99 | struct dentry *de = file->f_path.dentry; |
Mark Drayton | 7434731 | 2016-08-25 20:46:35 +0100 | [diff] [blame] | 100 | int mode = file->f_inode->i_mode; |
Paul Chaignon | f86f7e8 | 2018-06-14 02:20:03 +0200 | [diff] [blame] | 101 | struct qstr d_name = de->d_name; |
| 102 | if (d_name.len == 0 || TYPE_FILTER) |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 103 | return 0; |
| 104 | |
| 105 | // store counts and sizes by pid & file |
Hengqi Chen | d567347 | 2021-07-28 23:49:11 +0800 | [diff] [blame] | 106 | struct info_t info = { |
| 107 | .pid = pid, |
| 108 | .inode = file->f_inode->i_ino, |
Hengqi Chen | 7db3488 | 2022-01-30 11:14:57 +0800 | [diff] [blame] | 109 | .dev = file->f_inode->i_sb->s_dev, |
| 110 | .rdev = file->f_inode->i_rdev, |
Hengqi Chen | d567347 | 2021-07-28 23:49:11 +0800 | [diff] [blame] | 111 | }; |
Mark Drayton | 7434731 | 2016-08-25 20:46:35 +0100 | [diff] [blame] | 112 | bpf_get_current_comm(&info.comm, sizeof(info.comm)); |
Paul Chaignon | f86f7e8 | 2018-06-14 02:20:03 +0200 | [diff] [blame] | 113 | info.name_len = d_name.len; |
Sumanth Korikkar | 7f6066d | 2020-05-20 10:49:56 -0500 | [diff] [blame] | 114 | bpf_probe_read_kernel(&info.name, sizeof(info.name), d_name.name); |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 115 | if (S_ISREG(mode)) { |
| 116 | info.type = 'R'; |
| 117 | } else if (S_ISSOCK(mode)) { |
| 118 | info.type = 'S'; |
| 119 | } else { |
| 120 | info.type = 'O'; |
| 121 | } |
| 122 | |
| 123 | struct val_t *valp, zero = {}; |
yonghong-song | 82f4302 | 2019-10-31 08:16:12 -0700 | [diff] [blame] | 124 | valp = counts.lookup_or_try_init(&info, &zero); |
Philip Gladstone | ba64f03 | 2019-09-20 01:12:01 -0400 | [diff] [blame] | 125 | if (valp) { |
| 126 | if (is_read) { |
| 127 | valp->reads++; |
| 128 | valp->rbytes += count; |
| 129 | } else { |
| 130 | valp->writes++; |
| 131 | valp->wbytes += count; |
| 132 | } |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 133 | } |
| 134 | |
| 135 | return 0; |
| 136 | } |
| 137 | |
| 138 | int trace_read_entry(struct pt_regs *ctx, struct file *file, |
| 139 | char __user *buf, size_t count) |
| 140 | { |
| 141 | return do_entry(ctx, file, buf, count, 1); |
| 142 | } |
| 143 | |
| 144 | int trace_write_entry(struct pt_regs *ctx, struct file *file, |
| 145 | char __user *buf, size_t count) |
| 146 | { |
| 147 | return do_entry(ctx, file, buf, count, 0); |
| 148 | } |
| 149 | |
| 150 | """ |
Mark Drayton | 7434731 | 2016-08-25 20:46:35 +0100 | [diff] [blame] | 151 | if args.tgid: |
| 152 | bpf_text = bpf_text.replace('TGID_FILTER', 'tgid != %d' % args.tgid) |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 153 | else: |
Mark Drayton | 7434731 | 2016-08-25 20:46:35 +0100 | [diff] [blame] | 154 | bpf_text = bpf_text.replace('TGID_FILTER', '0') |
| 155 | if args.all_files: |
| 156 | bpf_text = bpf_text.replace('TYPE_FILTER', '0') |
| 157 | else: |
| 158 | bpf_text = bpf_text.replace('TYPE_FILTER', '!S_ISREG(mode)') |
| 159 | |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 160 | if debug or args.ebpf: |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 161 | print(bpf_text) |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 162 | if args.ebpf: |
| 163 | exit() |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 164 | |
| 165 | # initialize BPF |
| 166 | b = BPF(text=bpf_text) |
Jazel Canseco | 6d818b6 | 2018-04-13 11:39:56 -0700 | [diff] [blame] | 167 | b.attach_kprobe(event="vfs_read", fn_name="trace_read_entry") |
| 168 | b.attach_kprobe(event="vfs_write", fn_name="trace_write_entry") |
Mark Drayton | 7434731 | 2016-08-25 20:46:35 +0100 | [diff] [blame] | 169 | |
| 170 | DNAME_INLINE_LEN = 32 # linux/dcache.h |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 171 | |
| 172 | print('Tracing... Output every %d secs. Hit Ctrl-C to end' % interval) |
| 173 | |
Joel Fernandes (Google) | c2b371d | 2019-03-08 11:39:42 -0500 | [diff] [blame] | 174 | def sort_fn(counts): |
| 175 | if args.sort == "all": |
| 176 | return (counts[1].rbytes + counts[1].wbytes + counts[1].reads + counts[1].writes) |
| 177 | else: |
| 178 | return getattr(counts[1], args.sort) |
| 179 | |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 180 | # output |
| 181 | exiting = 0 |
| 182 | while 1: |
| 183 | try: |
| 184 | sleep(interval) |
| 185 | except KeyboardInterrupt: |
| 186 | exiting = 1 |
| 187 | |
| 188 | # header |
| 189 | if clear: |
| 190 | call("clear") |
| 191 | else: |
| 192 | print() |
| 193 | with open(loadavg) as stats: |
| 194 | print("%-8s loadavg: %s" % (strftime("%H:%M:%S"), stats.read())) |
Hengqi Chen | d567347 | 2021-07-28 23:49:11 +0800 | [diff] [blame] | 195 | print("%-7s %-16s %-6s %-6s %-7s %-7s %1s %s" % ("TID", "COMM", |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 196 | "READS", "WRITES", "R_Kb", "W_Kb", "T", "FILE")) |
| 197 | |
Mark Drayton | 7434731 | 2016-08-25 20:46:35 +0100 | [diff] [blame] | 198 | # by-TID output |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 199 | counts = b.get_table("counts") |
| 200 | line = 0 |
| 201 | for k, v in reversed(sorted(counts.items(), |
Joel Fernandes (Google) | c2b371d | 2019-03-08 11:39:42 -0500 | [diff] [blame] | 202 | key=sort_fn)): |
jeromemarchand | b96ebcd | 2018-10-10 01:58:15 +0200 | [diff] [blame] | 203 | name = k.name.decode('utf-8', 'replace') |
Mark Drayton | 7434731 | 2016-08-25 20:46:35 +0100 | [diff] [blame] | 204 | if k.name_len > DNAME_INLINE_LEN: |
| 205 | name = name[:-3] + "..." |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 206 | |
| 207 | # print line |
Hengqi Chen | d567347 | 2021-07-28 23:49:11 +0800 | [diff] [blame] | 208 | print("%-7d %-16s %-6d %-6d %-7d %-7d %1s %s" % (k.pid, |
jeromemarchand | b96ebcd | 2018-10-10 01:58:15 +0200 | [diff] [blame] | 209 | k.comm.decode('utf-8', 'replace'), v.reads, v.writes, |
| 210 | v.rbytes / 1024, v.wbytes / 1024, |
| 211 | k.type.decode('utf-8', 'replace'), name)) |
Brendan Gregg | 08c2981 | 2016-02-09 00:36:43 -0800 | [diff] [blame] | 212 | |
| 213 | line += 1 |
| 214 | if line >= maxrows: |
| 215 | break |
| 216 | counts.clear() |
| 217 | |
| 218 | countdown -= 1 |
| 219 | if exiting or countdown == 0: |
| 220 | print("Detaching...") |
| 221 | exit() |