You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
97 lines
2.8 KiB
97 lines
2.8 KiB
Demonstrations of stacksnoop, the Linux eBPF/bcc version.
|
|
|
|
|
|
This program traces the given kernel function and prints the kernel stack trace
|
|
for every call. This tool is useful for studying low frequency kernel functions,
|
|
to see how they were invoked. For example, tracing the submit_bio() call:
|
|
|
|
# ./stacksnoop submit_bio
|
|
TIME(s) SYSCALL
|
|
3592.838736000 submit_bio
|
|
submit_bio
|
|
submit_bh
|
|
jbd2_journal_commit_transaction
|
|
kjournald2
|
|
kthread
|
|
ret_from_fork
|
|
|
|
This shows that submit_bio() was called by submit_bh(), which was called
|
|
by jbd2_journal_commit_transaction(), and so on.
|
|
|
|
For high frequency functions, see stackcount, which summarizes in-kernel for
|
|
efficiency. If you don't know if your function is low or high frequency, try
|
|
funccount.
|
|
|
|
|
|
The -v option includes more fields, including the on-CPU process (COMM and PID):
|
|
|
|
# ./stacksnoop -v submit_bio
|
|
TIME(s) COMM PID CPU SYSCALL
|
|
3734.855027000 jbd2/dm-0-8 313 0 submit_bio
|
|
submit_bio
|
|
submit_bh
|
|
jbd2_journal_commit_transaction
|
|
kjournald2
|
|
kthread
|
|
ret_from_fork
|
|
|
|
This identifies the application issuing the sync syscall: the jbd2 process
|
|
(COMM column).
|
|
|
|
|
|
Here's another example, showing the path to second_overflow() and on-CPU
|
|
process:
|
|
|
|
# ./stacksnoop -v second_overflow
|
|
TIME(s) COMM PID CPU SYSCALL
|
|
3837.526433000 <idle> 0 1 second_overflow
|
|
second_overflow
|
|
tick_do_update_jiffies64
|
|
tick_irq_enter
|
|
irq_enter
|
|
smp_apic_timer_interrupt
|
|
apic_timer_interrupt
|
|
default_idle
|
|
arch_cpu_idle
|
|
default_idle_call
|
|
cpu_startup_entry
|
|
start_secondary
|
|
|
|
3838.526953000 <idle> 0 1 second_overflow
|
|
second_overflow
|
|
tick_do_update_jiffies64
|
|
tick_irq_enter
|
|
irq_enter
|
|
smp_apic_timer_interrupt
|
|
apic_timer_interrupt
|
|
default_idle
|
|
arch_cpu_idle
|
|
default_idle_call
|
|
cpu_startup_entry
|
|
start_secondary
|
|
|
|
This fires every second (see TIME(s)), and is from tick_do_update_jiffies64().
|
|
|
|
|
|
USAGE message:
|
|
|
|
# ./stacksnoop -h
|
|
usage: stacksnoop [-h] [-p PID] [-s] [-v] function
|
|
|
|
Trace and print kernel stack traces for a kernel function
|
|
|
|
positional arguments:
|
|
function kernel function name
|
|
|
|
optional arguments:
|
|
-h, --help show this help message and exit
|
|
-p PID, --pid PID trace this PID only
|
|
-s, --offset show address offsets
|
|
-v, --verbose print more fields
|
|
|
|
examples:
|
|
./stacksnoop ext4_sync_fs # print kernel stack traces for ext4_sync_fs
|
|
./stacksnoop -s ext4_sync_fs # ... also show symbol offsets
|
|
./stacksnoop -v ext4_sync_fs # ... show extra columns
|
|
./stacksnoop -p 185 ext4_sync_fs # ... only when PID 185 is on-CPU
|