You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
160 lines
6.8 KiB
160 lines
6.8 KiB
Demonstrations of filetop, the Linux eBPF/bcc version.
|
|
|
|
|
|
filetop shows reads and writes by file, with process details. For example:
|
|
|
|
# ./filetop -C
|
|
Tracing... Output every 1 secs. Hit Ctrl-C to end
|
|
|
|
08:00:23 loadavg: 0.91 0.33 0.23 3/286 26635
|
|
|
|
PID COMM READS WRITES R_Kb W_Kb T FILE
|
|
26628 ld 161 186 643 152 R built-in.o
|
|
26634 cc1 1 0 200 0 R autoconf.h
|
|
26618 cc1 1 0 200 0 R autoconf.h
|
|
26634 cc1 12 0 192 0 R tracepoint.h
|
|
26584 cc1 2 0 143 0 R mm.h
|
|
26634 cc1 2 0 143 0 R mm.h
|
|
26631 make 34 0 136 0 R auto.conf
|
|
26634 cc1 1 0 98 0 R fs.h
|
|
26584 cc1 1 0 98 0 R fs.h
|
|
26634 cc1 1 0 91 0 R sched.h
|
|
26634 cc1 1 0 78 0 R printk.c
|
|
26634 cc1 3 0 73 0 R mmzone.h
|
|
26628 ld 18 0 72 0 R hibernate.o
|
|
26628 ld 16 0 64 0 R suspend.o
|
|
26628 ld 16 0 64 0 R snapshot.o
|
|
26628 ld 16 0 64 0 R qos.o
|
|
26628 ld 13 0 52 0 R main.o
|
|
26628 ld 12 0 52 0 R swap.o
|
|
[...]
|
|
|
|
This shows various files read and written during a Linux kernel build. By
|
|
default the output is sorted by the total read size in Kbytes (R_Kb). Sorting
|
|
order can be changed via -s option. This is instrumenting at the VFS interface,
|
|
so this is reads and writes that may return entirely from the file system cache
|
|
(page cache).
|
|
|
|
While not printed, the average read and write size can be calculated by
|
|
dividing R_Kb by READS, and the same for writes.
|
|
|
|
The "T" column indicates the type of the file: "R" for regular files, "S" for
|
|
sockets, and "O" for other (including pipes). By default only regular files are
|
|
shown; use the -a option to show all file types.
|
|
|
|
This script works by tracing the vfs_read() and vfs_write() functions using
|
|
kernel dynamic tracing, which instruments explicit read and write calls. If
|
|
files are read or written using another means (eg, via mmap()), then they
|
|
will not be visible using this tool.
|
|
|
|
This should be useful for file system workload characterization when analyzing
|
|
the performance of applications.
|
|
|
|
Note that tracing VFS level reads and writes can be a frequent activity, and
|
|
this tool can begin to cost measurable overhead at high I/O rates.
|
|
|
|
|
|
A -C option will stop clearing the screen, and -r with a number will restrict
|
|
the output to that many rows (20 by default). For example, not clearing
|
|
the screen and showing the top 5 only:
|
|
|
|
# ./filetop -Cr 5
|
|
Tracing... Output every 1 secs. Hit Ctrl-C to end
|
|
|
|
08:05:11 loadavg: 0.75 0.35 0.25 3/285 822
|
|
|
|
PID COMM READS WRITES R_Kb W_Kb T FILE
|
|
32672 cksum 5006 0 320384 0 R data1
|
|
809 run 2 0 8 0 R nsswitch.conf
|
|
811 run 2 0 8 0 R nsswitch.conf
|
|
804 chown 2 0 8 0 R nsswitch.conf
|
|
|
|
08:05:12 loadavg: 0.75 0.35 0.25 3/285 845
|
|
|
|
PID COMM READS WRITES R_Kb W_Kb T FILE
|
|
32672 cksum 4986 0 319104 0 R data1
|
|
845 chown 2 0 8 0 R nsswitch.conf
|
|
828 run 2 0 8 0 R nsswitch.conf
|
|
835 run 2 0 8 0 R nsswitch.conf
|
|
830 run 2 0 8 0 R nsswitch.conf
|
|
|
|
08:05:13 loadavg: 0.75 0.35 0.25 3/285 868
|
|
|
|
PID COMM READS WRITES R_Kb W_Kb T FILE
|
|
32672 cksum 4985 0 319040 0 R data1
|
|
857 run 2 0 8 0 R nsswitch.conf
|
|
858 run 2 0 8 0 R nsswitch.conf
|
|
859 run 2 0 8 0 R nsswitch.conf
|
|
848 run 2 0 8 0 R nsswitch.conf
|
|
[...]
|
|
|
|
This output shows a cksum command reading data1.
|
|
|
|
|
|
An optional interval and optional count can also be added to the end of the
|
|
command line. For example, for 1 second interval, and 3 summaries in total:
|
|
|
|
# ./filetop -Cr 5 -a 1 3
|
|
Tracing... Output every 1 secs. Hit Ctrl-C to end
|
|
|
|
08:08:20 loadavg: 0.30 0.42 0.31 3/282 5187
|
|
|
|
PID COMM READS WRITES R_Kb W_Kb T FILE
|
|
12421 sshd 14101 0 225616 0 O ptmx
|
|
12296 sshd 4 0 64 0 O ptmx
|
|
12421 sshd 3 14104 48 778 S TCP
|
|
5178 run 2 0 8 0 R nsswitch.conf
|
|
5165 run 2 0 8 0 R nsswitch.conf
|
|
|
|
08:08:21 loadavg: 0.30 0.42 0.31 5/282 5210
|
|
|
|
PID COMM READS WRITES R_Kb W_Kb T FILE
|
|
12421 sshd 9159 0 146544 0 O ptmx
|
|
12421 sshd 3 9161 48 534 S TCP
|
|
12296 sshd 1 0 16 0 S TCP
|
|
5188 run 2 0 8 0 R nsswitch.conf
|
|
5203 run 2 0 8 0 R nsswitch.conf
|
|
|
|
08:08:22 loadavg: 0.30 0.42 0.31 2/282 5233
|
|
|
|
PID COMM READS WRITES R_Kb W_Kb T FILE
|
|
12421 sshd 26166 0 418656 0 O ptmx
|
|
12421 sshd 4 26171 64 1385 S TCP
|
|
12296 sshd 1 0 16 0 O ptmx
|
|
5214 run 2 0 8 0 R nsswitch.conf
|
|
5227 run 2 0 8 0 R nsswitch.conf
|
|
Detaching...
|
|
|
|
This example shows the -a option to include all file types. It caught heavy
|
|
socket I/O from an sshd process, showing up as non-regular file types (the "O"
|
|
for other, and "S" for socket, in the type column: "T").
|
|
|
|
|
|
USAGE message:
|
|
|
|
# ./filetop -h
|
|
usage: filetop.py [-h] [-a] [-C] [-r MAXROWS] [-p PID] [interval] [count]
|
|
|
|
File reads and writes by process
|
|
|
|
positional arguments:
|
|
interval output interval, in seconds
|
|
count number of outputs
|
|
|
|
optional arguments:
|
|
-h, --help show this help message and exit
|
|
-a, --all-files include non-regular file types (sockets, FIFOs, etc)
|
|
-C, --noclear don't clear the screen
|
|
-r MAXROWS, --maxrows MAXROWS
|
|
maximum rows to print, default 20
|
|
-s {reads,writes,rbytes,wbytes}, --sort {reads,writes,rbytes,wbytes}
|
|
sort column, default rbytes
|
|
-p PID, --pid PID trace this PID only
|
|
|
|
examples:
|
|
./filetop # file I/O top, 1 second refresh
|
|
./filetop -C # don't clear the screen
|
|
./filetop -p 181 # PID 181 only
|
|
./filetop 5 # 5 second summaries
|
|
./filetop 5 10 # 5 second summaries, 10 times only
|