Skip to content

Commit a9661e9

Browse files
Rtoaxyonghong-song
Rtoax
authored and
yonghong-song
committed
tools/syncsnoop: Add more syscalls support
Add fsync(),fdatasync(),syncfs(),sync_file_range(),msync() syscalls to trace. For example: $ sudo ./syncsnoop.py TIME(s) COMM CALL 1173253.856512000 worker fdatasync 1173260.193706000 sync sync 1173261.478894000 syncfs syncfs 1173264.231075000 fsync fsync 1173264.297788000 fsync fdatasync 1173284.063700000 worker fdatasync 1173288.229822000 mkfs.ext4 fsync 1173304.818227000 worker fdatasync 1173315.065319000 journal-offline fsync Signed-off-by: Rong Tao <[email protected]>
1 parent e465189 commit a9661e9

File tree

2 files changed

+132
-12
lines changed

2 files changed

+132
-12
lines changed

‎tools/syncsnoop.py

Lines changed: 79 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,35 +12,111 @@
1212
#
1313
# 13-Aug-2015 Brendan Gregg Created this.
1414
# 19-Feb-2016 Allan McAleavy migrated to BPF_PERF_OUTPUT
15+
# 17-Jul-2024 Rong Tao Support more sync syscalls.
1516

1617
from __future__ import print_function
1718
from bcc import BPF
19+
from bcc.utils import printb
1820
import sys
1921

2022
# load BPF program
2123
b = BPF(text="""
24+
#include <linux/sched.h>
25+
26+
enum sync_syscalls {
27+
SYS_T_MIN,
28+
SYS_SYNC,
29+
SYS_FSYNC,
30+
SYS_FDATASYNC,
31+
SYS_MSYNC,
32+
SYS_SYNC_FILE_RANGE,
33+
SYS_SYNCFS,
34+
SYS_T_MAX,
35+
};
36+
2237
struct data_t {
38+
char comm[TASK_COMM_LEN];
39+
u32 sys;
2340
u64 ts;
2441
};
2542
2643
BPF_PERF_OUTPUT(events);
2744
28-
void syscall__sync(void *ctx) {
45+
static void __syscall(void *ctx, enum sync_syscalls sys) {
2946
struct data_t data = {};
47+
48+
bpf_get_current_comm(data.comm, sizeof(data.comm));
3049
data.ts = bpf_ktime_get_ns() / 1000;
50+
data.sys = sys;
51+
3152
events.perf_submit(ctx, &data, sizeof(data));
3253
};
54+
55+
void syscall__sync(void *ctx) {
56+
return __syscall(ctx, SYS_SYNC);
57+
}
58+
59+
void syscall__fsync(void *ctx) {
60+
return __syscall(ctx, SYS_FSYNC);
61+
}
62+
63+
void syscall__fdatasync(void *ctx) {
64+
return __syscall(ctx, SYS_FDATASYNC);
65+
}
66+
67+
void syscall__msync(void *ctx) {
68+
return __syscall(ctx, SYS_MSYNC);
69+
}
70+
71+
void syscall__sync_file_range(void *ctx) {
72+
return __syscall(ctx, SYS_SYNC_FILE_RANGE);
73+
}
74+
75+
void syscall__syncfs(void *ctx) {
76+
return __syscall(ctx, SYS_SYNCFS);
77+
}
3378
""")
79+
80+
class EventType(object):
81+
SYS_SYNC = 1,
82+
SYS_FSYNC = 2,
83+
SYS_FDATASYNC = 3,
84+
SYS_MSYNC = 4,
85+
SYS_SYNC_FILE_RANGE = 5,
86+
SYS_SYNCFS = 6,
87+
88+
sys_names = (
89+
"N/A",
90+
"sync",
91+
"fsync",
92+
"fdatasync",
93+
"msync",
94+
"sync_file_range",
95+
"syncfs",
96+
"N/A",
97+
)
98+
3499
b.attach_kprobe(event=b.get_syscall_fnname("sync"),
35100
fn_name="syscall__sync")
101+
b.attach_kprobe(event=b.get_syscall_fnname("fsync"),
102+
fn_name="syscall__fsync")
103+
b.attach_kprobe(event=b.get_syscall_fnname("fdatasync"),
104+
fn_name="syscall__fdatasync")
105+
b.attach_kprobe(event=b.get_syscall_fnname("msync"),
106+
fn_name="syscall__msync")
107+
b.attach_kprobe(event=b.get_syscall_fnname("sync_file_range"),
108+
fn_name="syscall__sync_file_range")
109+
b.attach_kprobe(event=b.get_syscall_fnname("syncfs"),
110+
fn_name="syscall__syncfs")
36111

37112
# header
38-
print("%-18s %s" % ("TIME(s)", "CALL"))
113+
print("%-18s %-16s %-16s" % ("TIME(s)", "COMM", "CALL"))
39114

40115
# process event
41116
def print_event(cpu, data, size):
42117
event = b["events"].event(data)
43-
print("%-18.9f sync()" % (float(event.ts) / 1000000))
118+
printb(b"%-18.9f %-16s" % (float(event.ts) / 1000000, event.comm), nl="")
119+
print(" %-16s" % sys_names[event.sys])
44120
sys.stdout.flush()
45121

46122
# loop with callback to print_event

‎tools/syncsnoop_example.txt

Lines changed: 53 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,58 @@
11
Demonstrations of syncsnoop, the Linux eBPF/bcc version.
22

3+
This program traces calls to the kernel sync(),fsync(),fdatasync(),syncfs(),
4+
sync_file_range(),msync() routine, with basic timestamps:
35

4-
This program traces calls to the kernel sync() routine, with basic timestamps:
5-
6-
# ./syncsnoop
7-
TIME(s) CALL
8-
16458148.611952 sync()
9-
16458151.533709 sync()
6+
$ sudo ./syncsnoop.py
7+
TIME(s) COMM CALL
8+
1173253.856512000 worker fdatasync
9+
1173253.858791000 worker fdatasync
10+
1173260.193706000 sync sync
11+
1173261.478894000 syncfs syncfs
12+
1173264.231075000 fsync fsync
13+
1173264.297788000 fsync fdatasync
14+
1173266.303600000 fdatasync fsync
15+
1173266.372047000 fdatasync fdatasync
16+
1173284.063700000 worker fdatasync
17+
1173284.089607000 worker fdatasync
18+
1173288.229822000 mkfs.ext4 fsync
19+
1173288.304501000 mkfs.ext4 fsync
20+
1173288.308225000 mkfs.ext4 fsync
21+
1173288.315048000 mkfs.ext4 fsync
22+
1173304.818227000 worker fdatasync
23+
1173304.885796000 worker fdatasync
24+
1173304.890055000 worker fdatasync
25+
1173304.893487000 worker fdatasync
26+
1173305.351074000 worker fdatasync
27+
1173305.359278000 worker fdatasync
28+
1173314.272416000 worker fdatasync
29+
1173314.301972000 worker fdatasync
30+
1173315.065319000 journal-offline fsync
31+
1173315.065367000 journal-offline fsync
32+
1173315.107918000 journal-offline fsync
33+
1173315.117972000 journal-offline fsync
34+
1173330.613072000 vim fsync
35+
1173337.763989000 vim fsync
36+
1173343.513054000 vim fsync
37+
1173344.479574000 worker fdatasync
38+
1173344.484815000 worker fdatasync
39+
1173345.040061000 systemd-journal fsync
40+
1173374.477736000 vim fsync
41+
1173374.688049000 worker fdatasync
42+
1173374.696112000 worker fdatasync
43+
1173391.717910000 vim fsync
44+
1173400.458152000 vim fsync
45+
1173404.895497000 worker fdatasync
46+
1173404.920379000 worker fdatasync
47+
1173404.946869000 worker fdatasync
48+
1173416.849539000 vim fsync
49+
1173422.885377000 vim fsync
50+
1173427.481849000 sync_file_range sync_file_range
51+
1173435.104840000 worker fdatasync
52+
1173435.131895000 worker fdatasync
53+
1173435.158102000 worker fdatasync
54+
1173449.246568000 vim fsync
1055
^C
1156

12-
While tracing, the "sync" command was executed in another server session.
13-
14-
This can be useful to identify that sync() is being called, and its frequency.
57+
This can be useful to identify that sync(),fsync(),fdatasync(),syncfs(),
58+
sync_file_range(),msync() is being called, and its frequency.

0 commit comments

Comments
 (0)