I tried to run CO-RE version's runqslower failed, the error info: ENV With gdb's help, I found the `btf__find_by_name_kind` return -ENOENT. I printed all name: https://transfer.sh/ANKNs/log and found

Please correct me if I'm wrong about anything. When a perf_event is attached to a BPF program and the BPF program is going to do processing and then output what is the significant of wakeup_events or

<halivingston@...> wrote: Yes, you can do this.

I should have search. Short answer it fails and you're out of luck. https://lists.iovisor.org/g/iovisor-dev/topic/accessing_user_memory_and/21386221 <halivingston@...> wrote:

I'm curios to know how bpf_probe_read is able to read user-mode memory in the face of page faulting. I know in the helper it disables page faulting, but what does that mean? If the memory the probe

Imagine I have a per-cpu perf ring buffer for all my cpus. Now I have two eBPF programs. In both these eBPF programs I do bpf_update_elem(myFD, &cpunumberkey, &fdOfCPUspecificBuffer, BPF_ANY) Will

<halivingston@...> wrote: Perf event ring buffer is per cpu. Yes, it is what it did in the kernel. Each array element holds one ring buffer.

Thanks. I had to re-read your reply and the kernel code multiple times, but I think I get it now. Please confirm. It is this call is made by user mode code: fd =

PERF_EVENT_OUTPUT map is to hold per cpu ring buffers created by perf_event_open. That is why its typical size is the number of cpus on the host. <halivingston@...> wrote:

I'm very confused why BCC creates a map of number of processors for the perf_events output map. I can imagine it being 1 since all it does is act as a kernel-user mode intermediary and it is true

Hello, I was looking for a tool to collect latency on all IP connections through a linux router. We do have eBPF tools setup on the box. I am looking for something similar to tcpconnlat but need to

Thanks Quillian. I considered tracing sys_execve since execsnoop already provides sample code for that. I also need to trace process exits to remove the pid to command line mapping. This is a very

There's no API to access command line args. BPF_FUNC_get_current_comm will give you the task name. If it's not enough, you can try to get it via task_struct. Look for get_task_cmdline fs/proc/base.c

Hi all, bcc monitoring tools which print a process being traced print only the command (and pid, ppid) without the full args. In many cases the monitored command is a script, so the command is just

Hi all, I'm trying to trace zfs reads and writes and collect statistics for different pools using the pool name. Here is a simplified version that just has a call count.

0.9.3 is tagged: https://github.com/iovisor/bpftrace/releases/tag/v0.9.3 . Please see changelog for more details. Daniel

"Daniel Xu" <dxu@...> wrote: I would VERY much like to see a release, because I have bpftrace scripts that depend on latest git-tree (I think it's the 'int casts' that I depend on). My scripts

I'll update the 0.9.3 milestone and create a 0.9.4. In the future I'll try to keep milestones updated for PRs and issues. I guess this is also a good time to open the floor for other things

I was thinking about a 0.9.3 release and I noticed we had https://github.com/iovisor/bpftrace/milestone/6 but it appears neglected. Any thoughts on punting those issues and cutting a release

I think it may break a bunch of people who rely on bcc being a single library. What is the main motiviation to use libbpf as a shared library in libbcc? I think we can have both options. libbpf as