openSUSE eBPF/BCC workshop 小記
Notes:
- Kernel config 可以參考 /boot/ 下 config-開頭對應自己目前的核心, 看相關參數有沒有開
例如
# grep BPF /boot/config-4.4.46-11-default
CONFIG_BPF=y
CONFIG_BPF_SYSCALL=y
CONFIG_NETFILTER_XT_MATCH_BPF=m
CONFIG_NET_CLS_BPF=m
CONFIG_NET_ACT_BPF=m
CONFIG_BPF_JIT=y
CONFIG_HAVE_BPF_JIT=y
CONFIG_BPF_EVENTS=y
# CONFIG_TEST_BPF is not set
安裝相關套件
# zypper in python-bcc
# zypper in bcc-examples
相關 examples 存放地方
# pwd
/usr/share/bcc/examples
觀察 hello world
# cat /usr/share/bcc/examples/hello_world.py
#!/usr/bin/env python
# Copyright (c) PLUMgrid, Inc.
# Licensed under the Apache License, Version 2.0 (the "License")
# run in project examples directory with:
# sudo ./hello_world.py"
# see trace_fields.py for a longer example
from bcc import BPF
BPF(text='void kprobe__sys_clone(void *ctx) { bpf_trace_printk("Hello, World!\\n"); }').trace_print()
安裝 ( 更新 ) 目前的 kernel-default
# zypper in kernel-default
重新開機
# reboot
執行相關測試
# cd /usr/share/bcc/examples/
執行 hello_world.py
# python /usr/share/bcc/examples/hello_world.py
接下來可以嘗試在另外一個視窗 ssh 機器
就可以觀察到相關輸出
template:/usr/share/bcc/examples # python /usr/share/bcc/examples/hello_world.py
sshd-2314 [001] d..2 479.045754: : Hello, World!
sshd-2864 [000] d..2 479.072225: : Hello, World!
sshd-2864 [000] d..2 479.172032: : Hello, World!
sshd-2864 [000] d..2 485.447949: : Hello, World!
另外一個測試
# cat /usr/share/bcc/examples/tracing/trace_fields.py
#!/usr/bin/env python
# Copyright (c) PLUMgrid, Inc.
# Licensed under the Apache License, Version 2.0 (the "License")
# This is an example of tracing an event and printing custom fields.
# run in project examples directory with:
# sudo ./trace_fields.py"
from bcc import BPF
prog = """
int hello(void *ctx) {
bpf_trace_printk("Hello, World!\\n");
return 0;
}
"""
b = BPF(text=prog)
b.attach_kprobe(event="sys_clone", fn_name="hello")
print "PID MESSAGE"
b.trace_print(fmt="{1} {5}")
進行測試
# python /usr/share/bcc/examples/tracing/trace_fields.py
PID MESSAGE
2954 Hello, World!
2473 Hello, World!
3042 Hello, World!
# cd /usr/share/bcc/examples/tracing/
# wget https://raw.githubusercontent.com/iovisor/bcc/master/examples/tracing/sync_timing.py
# cat sync_timing.py
#!/usr/bin/python
#
# sync_timing.py Trace time between syncs.
# For Linux, uses BCC, eBPF. Embedded C.
#
# Written as a basic example of tracing time between events.
#
# Copyright 2016 Netflix, Inc.
# Licensed under the Apache License, Version 2.0 (the "License")
from __future__ import print_function
from bcc import BPF
# load BPF program
b = BPF(text="""
#include <uapi/linux/ptrace.h>
#include <linux/blkdev.h>
BPF_HASH(last);
void do_trace(struct pt_regs *ctx) {
u64 ts, *tsp, delta, key = 0;
// attempt to read stored timestamp
tsp = last.lookup(&key);
if (tsp != 0) {
delta = bpf_ktime_get_ns() - *tsp;
if (delta < 1000000000) {
// output if time is less than 1 second
bpf_trace_printk("%d\\n", delta / 1000000);
}
last.delete(&key);
}
// update stored timestamp
ts = bpf_ktime_get_ns();
last.update(&key, &ts);
}
""")
b.attach_kprobe(event="sys_sync", fn_name="do_trace")
print("Tracing for quick sync's... Ctrl-C to end")
# format output
start = 0
while 1:
(task, pid, cpu, flags, ts, ms) = b.trace_fields()
if start == 0:
start = ts
ts = ts - start
print("At time %.2f s: multiple syncs detected, last %s ms ago" % (ts, ms))
執行 sync_timing.py ( 另外在新視窗執行 #sync;sync;sync )
# python /usr/share/bcc/examples/tracing/sync_timing.py
Tracing for quick sync's... Ctrl-C to end
At time 0.00 s: multiple syncs detected, last 177 ms ago
At time 0.16 s: multiple syncs detected, last 161 ms ago
At time 15.44 s: multiple syncs detected, last 1 ms ago
At time 15.44 s: multiple syncs detected, last 1 ms ago
At time 15.44 s: multiple syncs detected, last 1 ms ago
執行另外一個測試
# python /usr/share/bcc/examples/tracing/disksnoop.py
TIME(s) T BYTES LAT(ms)
4578.806008000 R 8 0.06
4580.853965000 R 8 0.06
4581.622036000 W 6144 0.12
執行另外一個測試
個人覺得這個測試很好用, 可以統計較常用的 block 大小 :)
# python /usr/share/bcc/examples/tracing/bitehist.py
Tracing... Hit Ctrl-C to end.
^C
kbytes : count distribution
0 -> 1 : 8 |****************************************|
2 -> 3 : 1 |***** |
4 -> 7 : 0 | |
8 -> 15 : 0 | |
16 -> 31 : 1 |***** |
# cat /usr/share/bcc/examples/tracing/bitehist.py
#!/usr/bin/python
#
# bitehist.py Block I/O size histogram.
# For Linux, uses BCC, eBPF. See .c file.
#
# Written as a basic example of using a histogram to show a distribution.
#
# The default interval is 5 seconds. A Ctrl-C will print the partially
# gathered histogram then exit.
#
# Copyright (c) 2015 Brendan Gregg.
# Licensed under the Apache License, Version 2.0 (the "License")
#
# 15-Aug-2015 Brendan Gregg Created this.
from bcc import BPF
from time import sleep
# load BPF program
b = BPF(src_file = "bitehist.c")
# header
print("Tracing... Hit Ctrl-C to end.")
# trace until Ctrl-C
try:
sleep(99999999)
except KeyboardInterrupt:
print
# output
b["dist"].print_log2_hist("kbytes")
感謝今天 AL 分享
~ enjoy it
