bpftrace手册中如何详细查询并应用所有功能?
摘要:目录来源man bpftrace笔记-v--info支持if和else if支持的基本数据类型sizeofoffsetofbufwatchpoint和asyncwatchpoint循环的3中写法map变量(@)和临时变量($)位置变量内核栈
目录来源man bpftrace笔记-v--info支持if和else if支持的基本数据类型sizeofoffsetofbufwatchpoint和asyncwatchpoint循环的3中写法map变量(@)和临时变量($)位置变量内核栈的输出格式打印map变量的最高若干个遍历kfunckproberawtracepoint和tracepoint区别CONFIG变量环境变量同步和异步调用
来源
https://github.com/bpftrace/bpftrace/releases/tag/v0.21.2
https://bpftrace.org/
man bpftrace
点击查看代码
BPFTRACE(8) BPFTRACE(8)
NAME
bpftrace - a high-level tracing language
SYNOPSIS
bpftrace [OPTIONS] FILENAME
bpftrace [OPTIONS] -e 'program code'
When FILENAME is "-", bpftrace will read program code from stdin.
DESCRIPTION
bpftrace is a high-level tracing language and runtime for Linux based on eBPF. It supports static and dynamic tracing for both the kernel and user-space.
EXAMPLES
Trace processes calling sleep
# bpftrace -e 'kprobe:do_nanosleep { printf("%d sleeping\n", pid); }'
Trace processes calling sleep while spawning sleep 5 as a child process
# bpftrace -e 'kprobe:do_nanosleep { printf("%d sleeping\n", pid); }' -c 'sleep 5'
List all probes with "sleep" in their name
# bpftrace -l '*sleep*'
List all the probes attached in the program
# bpftrace -l -e 'kprobe:do_nanosleep { printf("%d sleeping\n", pid); }'
SUPPORTED ARCHITECTURES
x86_64, arm64, s390x, arm32, loongarch64, mips64, ppc64, riscv64
OPTIONS
-B MODE
Set the buffer mode for stdout.
Valid values are
none No buffering. Each I/O is written as soon as possible
line Data is written on the first newline or when the buffer is full. This is the default mode.
full Data is written once the buffer is full.
-c COMMAND
Run COMMAND as a child process. When the child terminates bpftrace will also terminate, as if 'exit()' had been c
