FileMgr

✏️ /usr/share/doc/bpftrace/examples/dcsnoop_example.txt

✕ Tutup

Demonstrations of dcsnoop, the Linux bpftrace/eBPF version.

dcsnoop traces directory entry cache (dcache) lookups, and can be used for
further investigation beyond dcstat(8). The output is likely verbose, as
dcache lookups are likely frequent. For example:

# ./dcsnoop.bt
Attaching 4 probes...
Tracing dcache lookups... Hit Ctrl-C to end.
TIME     PID    COMM             T FILE
427      1518   irqbalance       R proc/interrupts
427      1518   irqbalance       R interrupts
427      1518   irqbalance       R proc/stat
427      1518   irqbalance       R stat
483      2440   snmp-pass        R proc/cpuinfo
483      2440   snmp-pass        R cpuinfo
486      2440   snmp-pass        R proc/stat
486      2440   snmp-pass        R stat
834      1744   snmpd            R proc/net/dev
834      1744   snmpd            R net/dev
834      1744   snmpd            R self/net
834      1744   snmpd            R 1744
834      1744   snmpd            R net
834      1744   snmpd            R dev
834      1744   snmpd            R proc/net/if_inet6
834      1744   snmpd            R net/if_inet6
834      1744   snmpd            R self/net
834      1744   snmpd            R 1744
834      1744   snmpd            R net
834      1744   snmpd            R if_inet6
835      1744   snmpd            R sys/class/net/docker0/device/vendor
835      1744   snmpd            R class/net/docker0/device/vendor
835      1744   snmpd            R net/docker0/device/vendor
835      1744   snmpd            R docker0/device/vendor
835      1744   snmpd            R devices/virtual/net/docker0
835      1744   snmpd            R virtual/net/docker0
835      1744   snmpd            R net/docker0
835      1744   snmpd            R docker0
835      1744   snmpd            R device/vendor
835      1744   snmpd            R proc/sys/net/ipv4/neigh/docker0/retrans_time_ms
835      1744   snmpd            R sys/net/ipv4/neigh/docker0/retrans_time_ms
835      1744   snmpd            R net/ipv4/neigh/docker0/retrans_time_ms
835      1744   snmpd            R ipv4/neigh/docker0/retrans_time_ms
835      1744   snmpd            R neigh/docker0/retrans_time_ms
835      1744   snmpd            R docker0/retrans_time_ms
835      1744   snmpd            R retrans_time_ms
835      1744   snmpd            R proc/sys/net/ipv6/neigh/docker0/retrans_time_ms
835      1744   snmpd            R sys/net/ipv6/neigh/docker0/retrans_time_ms
835      1744   snmpd            R net/ipv6/neigh/docker0/retrans_time_ms
835      1744   snmpd            R ipv6/neigh/docker0/retrans_time_ms
835      1744   snmpd            R neigh/docker0/retrans_time_ms
835      1744   snmpd            R docker0/retrans_time_ms
835      1744   snmpd            R retrans_time_ms
835      1744   snmpd            R proc/sys/net/ipv6/conf/docker0/forwarding
835      1744   snmpd            R sys/net/ipv6/conf/docker0/forwarding
835      1744   snmpd            R net/ipv6/conf/docker0/forwarding
835      1744   snmpd            R ipv6/conf/docker0/forwarding
835      1744   snmpd            R conf/docker0/forwarding
[...]
5154     934    cksum            R usr/bin/basename
5154     934    cksum            R bin/basename
5154     934    cksum            R basename
5154     934    cksum            R usr/bin/bashbug
5154     934    cksum            R bin/bashbug
5154     934    cksum            R bashbug
5154     934    cksum            M bashbug
5155     934    cksum            R usr/bin/batch
5155     934    cksum            R bin/batch
5155     934    cksum            R batch
5155     934    cksum            M batch
5155     934    cksum            R usr/bin/bc
5155     934    cksum            R bin/bc
5155     934    cksum            R bc
5155     934    cksum            M bc
5169     934    cksum            R usr/bin/bdftopcf
5169     934    cksum            R bin/bdftopcf
5169     934    cksum            R bdftopcf
5169     934    cksum            M bdftopcf
5173     934    cksum            R usr/bin/bdftruncate
5173     934    cksum            R bin/bdftruncate
5173     934    cksum            R bdftruncate
5173     934    cksum            M bdftruncate

The way the dcache is currently implemented, each component of a path is
checked in turn. The first line, showing "proc/interrupts" from irqbalance,
will be a lookup for "proc" in a directory (that isn't shown here). If it
finds "proc", it will then lookup "interrupts" inside net.

The script is easily modifiable to only show misses, reducing the volume of
the output. Or use the bcc version of this tool, which only shows misses by
default: https://github.com/iovisor/bcc

Batal

⬅ bpftrace 38 item

Nama	Tipe	Ukuran	Diubah	Perm	Aksi
📝 bashreadline_example.txt	txt	722 B	07/03/24 22:14	0644	✏️ ⬇
📝 biolatency_example.txt	txt	1.7 KB	07/03/24 22:14	0644	✏️ ⬇
📝 biosnoop_example.txt	txt	2 KB	07/03/24 22:14	0644	✏️ ⬇
📝 biostacks_example.txt	txt	1.9 KB	07/03/24 22:14	0644	✏️ ⬇
📝 bitesize_example.txt	txt	2.9 KB	07/03/24 22:14	0644	✏️ ⬇
📝 capable_example.txt	txt	2.6 KB	07/03/24 22:14	0644	✏️ ⬇
📝 cpuwalk_example.txt	txt	4.8 KB	07/03/24 22:14	0644	✏️ ⬇
📝 dcsnoop_example.txt	txt	4.5 KB	07/03/24 22:14	0644	✏️ ⬇
📝 execsnoop_example.txt	txt	1.5 KB	07/03/24 22:14	0644	✏️ ⬇
📝 gethostlatency_example.txt	txt	923 B	07/03/24 22:14	0644	✏️ ⬇
📝 killsnoop_example.txt	txt	846 B	07/03/24 22:14	0644	✏️ ⬇
📝 loads_example.txt	txt	864 B	07/03/24 22:14	0644	✏️ ⬇
📝 mdflush_example.txt	txt	1.8 KB	07/03/24 22:14	0644	✏️ ⬇
📝 naptime_example.txt	txt	844 B	07/03/24 22:14	0644	✏️ ⬇
📝 oomkill_example.txt	txt	1.6 KB	07/03/24 22:14	0644	✏️ ⬇
📝 opensnoop_example.txt	txt	2.5 KB	07/03/24 22:14	0644	✏️ ⬇
📝 pidpersec_example.txt	txt	1.5 KB	07/03/24 22:14	0644	✏️ ⬇
📝 runqlat_example.txt	txt	8.4 KB	07/03/24 22:14	0644	✏️ ⬇
📝 runqlen_example.txt	txt	980 B	07/03/24 22:14	0644	✏️ ⬇
📝 setuids_example.txt	txt	2.4 KB	07/03/24 22:14	0644	✏️ ⬇
📝 ssllatency_example.txt	txt	4.4 KB	07/03/24 22:14	0644	✏️ ⬇
📝 sslsnoop_example.txt	txt	1.9 KB	07/03/24 22:14	0644	✏️ ⬇
📝 statsnoop_example.txt	txt	2.7 KB	07/03/24 22:14	0644	✏️ ⬇
📝 swapin_example.txt	txt	549 B	07/03/24 22:14	0644	✏️ ⬇
📝 syncsnoop_example.txt	txt	541 B	07/03/24 22:14	0644	✏️ ⬇
📝 syscount_example.txt	txt	1.1 KB	07/03/24 22:14	0644	✏️ ⬇
📝 tcpaccept_example.txt	txt	1.3 KB	07/03/24 22:14	0644	✏️ ⬇
📝 tcpconnect_example.txt	txt	1.1 KB	07/03/24 22:14	0644	✏️ ⬇
📝 tcpdrop_example.txt	txt	1.2 KB	07/03/24 22:14	0644	✏️ ⬇
📝 tcplife_example.txt	txt	1.6 KB	07/03/24 22:14	0644	✏️ ⬇
📝 tcpretrans_example.txt	txt	1.1 KB	07/03/24 22:14	0644	✏️ ⬇
📝 tcpsynbl_example.txt	txt	940 B	07/03/24 22:14	0644	✏️ ⬇
📝 threadsnoop_example.txt	txt	1.2 KB	07/03/24 22:14	0644	✏️ ⬇
📝 undump_example.txt	txt	680 B	07/03/24 22:14	0644	✏️ ⬇
📝 vfscount_example.txt	txt	1.2 KB	07/03/24 22:14	0644	✏️ ⬇
📝 vfsstat_example.txt	txt	929 B	07/03/24 22:14	0644	✏️ ⬇
📝 writeback_example.txt	txt	1.9 KB	07/03/24 22:14	0644	✏️ ⬇
📝 xfsdist_example.txt	txt	3.3 KB	07/03/24 22:14	0644	✏️ ⬇

✏️ Rename

🔑 Ubah Permission