ebpf-5——实用案例汇总

1. 统计函数每次执行耗时

bpftrace -e 'kprobe:vfs_read { @start[tid] = nsecs; }
    kretprobe:vfs_read /@start[tid]/ {@us[pid] = nsecs - @start[tid]; delete(@start[tid]); }
    END { print(@us, 0, 1000); clear(@us); clear(@start); }'

2. 谁打开了特定文件

# bpftrace -e 'kprobe:do_sys_openat2 / str(uptr(arg1)) == "/dev/cpuset/top-app/tasks" / { printf("tid=%d comm=%s open file %s\n", tid, comm, str(uptr(arg1))); }'
# bpftrace -e 'kprobe:do_sys_openat2 / str(uptr(arg1)) == "/dev/cpuset/top-app/tasks" / { printf("tid=%d comm=%s open file %s, ustack: %s\n", tid,  comm, str(uptr(arg1)), ustack(perf)); }'

3. 一个进程休眠了多长时间

(1) 所有进程

# bpftrace -e 'kprobe:do_nanosleep { @start[tid] = nsecs; } 
　　kretprobe:do_nanosleep /@start[tid] != 0/ { printf("tid=%d, comm=%s, slept for %d ms\n", tid, comm, (nsecs - @start[tid]) / 1000000); delete(@start[tid]); }'

(2) 指定单个线程

# bpftrace -e 'kprobe:do_nanosleep / tid == 1681 / { @start[tid] = nsecs; } 
　　kretprobe:do_nanosleep /@start[tid] != 0 /{ printf("tid=%d, comm=%s, slept for %d us\n", tid, comm, (nsecs - @start[tid]) / 1000); delete(@start[tid]); }'
Attaching 2 probes...
tid=1681, comm=surfaceflinger, slept for 844 us
^C