G'Day all, I have colleagues working on BCC Python tools (e.g., the recent enhancement of tcpconnect.py) and I'm wondering, given libbpf tools, what our advice should be. - Should we keep both Python

^^^^ sudo isn't safe. If you remove the BCC tool from this one-liner, you'll find it still destroys your disk. In practice the production concern I have is for the overhead of each tool, hence the ove

G'Day, Many of you already know (and have been helping, thanks) and we've discussed this on the iovisor call before: my book is finally launched properly. Some URLs: http://www.brendangregg.com/blog/2

G'Day, This is the biggest change afoot to the bpftrace API, and I think we can sort it out quickly without fuss, but it is worth sharing here. This is from https://github.com/iovisor/bpftrace/issues/

Following on from the call... Does this sound even better? (mapping from the JVM for comparison): The JVM is a specification of a virtual machine that runs Java bytecode. It is implemented by a Java R

The stack ID returned by ustack() points to a stack as a list of addresses. That gets translated sometime later in user-space by bpftrace. At that point you just have an address, and you need to know

C_INCLUDE_PATH=... environment variable should work. But you can file an RFE or PR anyway to add this to the docs. Thanks! Brendan

G'Day Evgenii, As in CONTRIBUTING_SCRIPTS.md, we're after tools that do one thing and do it well, so I'd generally avoid adding features that didn't belong in tools. In this case, it might actually be

Tools look excellent, thanks! When you're ready, could you submit as a github bcc PR? thanks, Brendan

G'Day, We've been working on wrapping up bpftrace for a while -- a high-level tracer for eBPF -- and we've now made the private repo public: https://github.com/iovisor/bpftrace Thanks Alastair Roberts

I'm ok with the workaround code, but I'd like a comment that clearly explains it for future maintainers and copy-n-pasters. Eg: // Skip entries with backwards time: temp workaround for #728 Then peopl

<peter.waskiewicz.jr@...> wrote: I expect to use BTF as a source for kernel struct information, as a lightweight version of debuginfo (and hopefully one day BTF info will be included in the kern

I'm hoping someone knows a workaround here. I have a char buf[128] and I'd like to write to arbitrary offsets, but keep hitting this error. Any workaround? I've included a sample bcc program below, wh

G'Day, For reference, I created a few bcc/BPF tools that generate data for these flame graphs. The tools are based on the offcputime code, and are: https://github.com/brendangregg/BPF-tools/blob/maste

Yes, there's at least three efforts: 1. https://github.com/iovisor/ply 2. https://github.com/ajor/bpftrace 3. SystemTap's eBPF backend I'm sure any of them would appreciate help. FWIW, bpftrace I thin

G'Day Sam, If you're not sure about the script, then I'd start here or with an issue. But an nfsslower similar to the others should be straightforward, so I'd go straight to a PR. Thanks, Brendan

Happening today? Brendan

G'Day, Please add talk/discussion proposals to the wiki, especially in-development projects you'd like to technically discuss: http://wiki.linuxplumbersconf.org/2017:tracing Brendan

Unfortunately I'll miss it this week. Have fun. Looking forward to BPF on all perf_event_open() events. :-) Brendan

I missed a possibility for A: SystemTap with a BPF backend (there were emails about this on lkml a while ago). Suchakra replied with other tools as well (thanks). Brendan