The other day I was in the process of porting a little libbpf application from Ubuntu 20 (Linux 5.4) to CentOS 8 (Linux 4.18). This program uses tracepoint:tcp:tcp_send_reset. Here's the relevant BPF

Hi *, I managed to setup adeb on a pixel4 with custom kernel compiled as suggested by adeb's README. The setup is working fine for some BCC tools, as vfsstat but a few as opensnoop and the trace comma

Hi, I am trying to write a BPF perf event program to get CPU runq length. The Following is the code snippet. I am observing that a big integer (len is 2839296536 ) as queue length in trace output for

Bcc has funclatency.py which support get function latency for the user program, using pid_tgid as the key. But when it comes to a program was written by golang which supports coroutine(goroutine), it

Hi all. Currently debugging a very strange behaviour with eBPF hash maps and was wondering if anyone else has run into a similar issue? I am using libbpf-rs with BPF CO-RE and my kernel version is 5.9

Hello Yonghong, all, I'm curious about a verifier workaround that Yonghong provided two years ago, in this thread. Brendan Gregg was asking about accessing stack buffers through a register with a vari

Hello, [Warning ⚠] Do you understand how to built bpf.file for snort on fedora? Thank you in advance, I hope the success, Regards. Dorian Rosse Téléchargez Outlook pour Android

I'm currently working on a python script to trace the nvme driver. I'm hitting a performance bottleneck on the event callback in python and am looking for the best way (or maybe a quick and dirty way)

Hi all, I am trying to find a way to represent wildcards in BPF Map Keys? I could not find anything relevant to that, does anyone know anything further. Are there any efforts towards that functionalit

Hi all, I am learning about ebpf and the bcc tools/library. I have a question about dynamic uprobe of C++ code. I have been able to attach a uprobe successfully by looking up the mangled symbol name.

G'Day all, I have colleagues working on BCC Python tools (e.g., the recent enhancement of tcpconnect.py) and I'm wondering, given libbpf tools, what our advice should be. - Should we keep both Python

Hello everyone! I am experiencing some issues with the execveat tracepoints, and was wondering if others could reproduce it or help me understand what I am doing wrong. On Arch Linux (kernel 5.9.1, pe

Does the LLVM version used by bcc matter, for packaging purposes? I assume bcc includes some static libraries from LLVM, so I'm curious if the older versions are acceptable. For instance, on ubuntu 16

Thanks a lot, Yonghong. From your response: 1. How can I make a kernel function use the return value of a eBPF program/function? 2. An KProbes related question: from an old article https://lwn.net/Art

Hello BPF community, I am looking for a way to move a user space program's disk I/O scheduling related logic down to kernel space, and then have the new kernel logic communicate with the user space pr

Hi, I am looking for tracking inbound connections on a system using tracepoints/kprobes. I was checking "trace_inet_sock_set_state", with which we can track the state changes during connection establi

Hi everyone, I am using inet_set_socket_state trace point to get current establish connection count Here, incrementing counter value in BPF map when new state is TCP_ESTABLISHED and decrementing when

I have to create a test-environment (based on vagrant) the last couple of days and i've done this with ubuntu 20.04 as base image. Is the repository https://github.com/iovisor/vagrant still active? If

Hi, Is it possible to load a BPF program at boot time? What I'm trying to achieve is to trace every single call to a certain function since the kernel starts, without missing anything. More specifical

Hello BPF Community! Hope you are all doing well. I am trying to have a user space program create a BPF Hash map with a single element containing its PID. This map could then be read by all the BPF pr