G'Day, I wrote a long script that, as a basic example, tries to do the following in C: int trace(struct pt_regs *ctx) { bpf_trace_printk("%d", ctx->ax); return 1; } Then consumes both the printk outpu

I dug through the list and realized that the actual integer I want to emit in this case -- which is not ctx->ax like my simple example, but is the thread blocked time -- can already be exposed as PERF

I'm considering creating a directory in bcc called /oldtools, for some older versions that work on the 4.4 kernel. With bpf_perf_event_output() in 4.5, there are many tools that I (or someone) should

Yes, lets have tools/old, to keep it simple. Great! I've been using bpf_perf_event_output() too (see my PR for ext4slower/xfslower), and had a few nits I need to file tickets on (I labeled some things

Not quite there yet, but another ten tools or so and it's going to get onerous to pick through a long listing. I'll take a swing at this myself -- I've already had directories in mind for these (as wi

Great! Is there a hello world example in there somewhere? I found this: # ./stapbpf/stapbpf -h Usage: ./stapbpf/stapbpf [-v][-w][-V][-h] [-o FILE] <bpf-file> -h, --help Show this help text -v, --verbo

Useful; is it possible we could also have versions that read to buffers? Just for a slight improvement over code like (from nodejs_http_server.py): char path[128]; bpf_usdt_readarg(6, ctx, &addr); bpf

G'Day Nan, I think it's messed up because you deleted the source, and now the build symlink is broken. Here's an Ubuntu system that does not have kernel source, and yet bcc works fine: # ls -l /lib/mo

G'Day, Great! Lowing overhead should open the door to new possibilities. Suchakra, was this the same dyninst as http://www.dyninst.org/dyninst? Just curious. Brendan

I'd like to BPF_PERF_OUTPUT() at a high rate (>1000/s), and have these buffered and read in groups by bcc. But the typical loop we're using: b["events"].open_perf_buffer(print_event) while 1: b.kprobe

I did some in the bcc ref guide, but it's incomplete, and the bcc versions: https://github.com/iovisor/bcc/blob/master/docs/reference_guide.md Brendan

As discussed on the call, here's who I think are the three audiences for bcc/BPF tracing: A) Kernel hackers (~100): who would like the language to be easier, better errors, docs, etc. B) Sysadmins/ope

I missed a possibility for A: SystemTap with a BPF backend (there were emails about this on lkml a while ago). Suchakra replied with other tools as well (thanks). Brendan

Unfortunately I'll miss it this week. Have fun. Looking forward to BPF on all perf_event_open() events. :-) Brendan

G'Day, Please add talk/discussion proposals to the wiki, especially in-development projects you'd like to technically discuss: http://wiki.linuxplumbersconf.org/2017:tracing Brendan

Happening today? Brendan

G'Day Sam, If you're not sure about the script, then I'd start here or with an issue. But an nfsslower similar to the others should be straightforward, so I'd go straight to a PR. Thanks, Brendan

Yes, there's at least three efforts: 1. https://github.com/iovisor/ply 2. https://github.com/ajor/bpftrace 3. SystemTap's eBPF backend I'm sure any of them would appreciate help. FWIW, bpftrace I thin

G'Day, For reference, I created a few bcc/BPF tools that generate data for these flame graphs. The tools are based on the offcputime code, and are: https://github.com/brendangregg/BPF-tools/blob/maste

I'm hoping someone knows a workaround here. I have a char buf[128] and I'd like to write to arbitrary offsets, but keep hitting this error. Any workaround? I've included a sample bcc program below, wh