bpftrace language preview

1. Tracing syscall latency

a kprobe/kretprobe pair, a predicate, and a map

horizon-dark

// trace slow syscalls
#include <linux/sched.h>

BEGIN
{
    printf("Tracing syscalls...\n");
}

kprobe:vfs_read
/pid == 1234/
{
    @start[tid] = nsecs;
}

kretprobe:vfs_read
{
    $dur = nsecs - @start[tid];
    printf("read took %d ns, arg0=%d\n", $dur, arg0);
}

atom-one-dark

// trace slow syscalls
#include <linux/sched.h>

BEGIN
{
    printf("Tracing syscalls...\n");
}

kprobe:vfs_read
/pid == 1234/
{
    @start[tid] = nsecs;
}

kretprobe:vfs_read
{
    $dur = nsecs - @start[tid];
    printf("read took %d ns, arg0=%d\n", $dur, arg0);
}

github-dark

// trace slow syscalls
#include <linux/sched.h>

BEGIN
{
    printf("Tracing syscalls...\n");
}

kprobe:vfs_read
/pid == 1234/
{
    @start[tid] = nsecs;
}

kretprobe:vfs_read
{
    $dur = nsecs - @start[tid];
    printf("read took %d ns, arg0=%d\n", $dur, arg0);
}

dracula

// trace slow syscalls
#include <linux/sched.h>

BEGIN
{
    printf("Tracing syscalls...\n");
}

kprobe:vfs_read
/pid == 1234/
{
    @start[tid] = nsecs;
}

kretprobe:vfs_read
{
    $dur = nsecs - @start[tid];
    printf("read took %d ns, arg0=%d\n", $dur, arg0);
}

nord

// trace slow syscalls
#include <linux/sched.h>

BEGIN
{
    printf("Tracing syscalls...\n");
}

kprobe:vfs_read
/pid == 1234/
{
    @start[tid] = nsecs;
}

kretprobe:vfs_read
{
    $dur = nsecs - @start[tid];
    printf("read took %d ns, arg0=%d\n", $dur, arg0);
}

github

// trace slow syscalls
#include <linux/sched.h>

BEGIN
{
    printf("Tracing syscalls...\n");
}

kprobe:vfs_read
/pid == 1234/
{
    @start[tid] = nsecs;
}

kretprobe:vfs_read
{
    $dur = nsecs - @start[tid];
    printf("read took %d ns, arg0=%d\n", $dur, arg0);
}

2. Histogram of syscall counts

the hist function and built-in variables

horizon-dark

tracepoint:raw_syscalls:sys_enter
{
    @syscalls[comm] = count();
}

END
{
    print(@syscalls);
}

atom-one-dark

tracepoint:raw_syscalls:sys_enter
{
    @syscalls[comm] = count();
}

END
{
    print(@syscalls);
}

github-dark

tracepoint:raw_syscalls:sys_enter
{
    @syscalls[comm] = count();
}

END
{
    print(@syscalls);
}

dracula

tracepoint:raw_syscalls:sys_enter
{
    @syscalls[comm] = count();
}

END
{
    print(@syscalls);
}

nord

tracepoint:raw_syscalls:sys_enter
{
    @syscalls[comm] = count();
}

END
{
    print(@syscalls);
}

github

tracepoint:raw_syscalls:sys_enter
{
    @syscalls[comm] = count();
}

END
{
    print(@syscalls);
}

3. Interval reporting

the interval probe and positional parameters

horizon-dark

interval:s:$1
{
    printf("pid %d, cpu %d\n", pid, cpu);
}

atom-one-dark

interval:s:$1
{
    printf("pid %d, cpu %d\n", pid, cpu);
}

github-dark

interval:s:$1
{
    printf("pid %d, cpu %d\n", pid, cpu);
}

dracula

interval:s:$1
{
    printf("pid %d, cpu %d\n", pid, cpu);
}

nord

interval:s:$1
{
    printf("pid %d, cpu %d\n", pid, cpu);
}

github

interval:s:$1
{
    printf("pid %d, cpu %d\n", pid, cpu);
}