You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
73 lines
1.8 KiB
73 lines
1.8 KiB
4 months ago
|
.TH filelife 8 "2016-02-08" "USER COMMANDS"
|
||
|
|
.SH NAME
|
||
|
|
filelife \- Trace the lifespan of short-lived files. Uses Linux eBPF/bcc.
|
||
|
|
.SH SYNOPSIS
|
||
|
|
.B filelife [\-h] [\-p PID]
|
||
|
|
.SH DESCRIPTION
|
||
|
|
This traces the creation and deletion of files, providing information
|
||
|
|
on who deleted the file, the file age, and the file name. The intent is to
|
||
|
|
provide information on short-lived files, for debugging or performance
|
||
|
|
analysis.
|
||
|
|
|
||
|
|
This works by tracing the kernel vfs_create() and vfs_delete() functions (and
|
||
|
|
maybe more, see the source) using dynamic tracing, and will need updating to
|
||
|
|
match any changes to these functions.
|
||
|
|
|
||
|
|
This makes use of a Linux 4.5 feature (bpf_perf_event_output());
|
||
|
|
for kernels older than 4.5, see the version under tools/old,
|
||
|
|
which uses an older mechanism.
|
||
|
|
|
||
|
|
Since this uses BPF, only the root user can use this tool.
|
||
|
|
.SH REQUIREMENTS
|
||
|
|
CONFIG_BPF and bcc.
|
||
|
|
.SH OPTIONS
|
||
|
|
.TP
|
||
|
|
\-h
|
||
|
|
Print usage message.
|
||
|
|
.TP
|
||
|
|
\-p PID
|
||
|
|
Trace this process ID only (filtered in-kernel).
|
||
|
|
.SH EXAMPLES
|
||
|
|
.TP
|
||
|
|
Trace all short-lived files, and print details:
|
||
|
|
#
|
||
|
|
.B filelife
|
||
|
|
.TP
|
||
|
|
Trace all short-lived files created AND deleted by PID 181:
|
||
|
|
#
|
||
|
|
.B filelife \-p 181
|
||
|
|
.SH FIELDS
|
||
|
|
.TP
|
||
|
|
TIME
|
||
|
|
Time of the deletion.
|
||
|
|
.TP
|
||
|
|
PID
|
||
|
|
Process ID that deleted the file.
|
||
|
|
.TP
|
||
|
|
COMM
|
||
|
|
Process name for the PID.
|
||
|
|
.TP
|
||
|
|
AGE(s)
|
||
|
|
Age of the file, from creation to deletion, in seconds.
|
||
|
|
.TP
|
||
|
|
FILE
|
||
|
|
Filename.
|
||
|
|
.SH OVERHEAD
|
||
|
|
This traces the kernel VFS file create and delete functions and prints output
|
||
|
|
for each delete. As the rate of this is generally expected to be low
|
||
|
|
(< 1000/s), the overhead is also expected to be negligible.
|
||
|
|
This is from bcc.
|
||
|
|
.IP
|
||
|
|
https://github.com/iovisor/bcc
|
||
|
|
.PP
|
||
|
|
Also look in the bcc distribution for a companion _examples.txt file containing
|
||
|
|
example usage, output, and commentary for this tool.
|
||
|
|
.SH OS
|
||
|
|
Linux
|
||
|
|
.SH STABILITY
|
||
|
|
Unstable - in development.
|
||
|
|
.SH AUTHOR
|
||
|
|
Brendan Gregg
|
||
|
|
.SH SEE ALSO
|
||
|
|
opensnoop(1)
|