forked from iovisor/bcc
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
3f95637
commit 12c234f
Showing
4 changed files
with
132 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,59 @@ | ||
.TH tcpsynbl 8 "2019-07-03" "USER COMMANDS" | ||
.SH NAME | ||
tcpsynbl \- Show the TCP SYN backlog as a histogram. Uses BCC/eBPF. | ||
.SH SYNOPSIS | ||
.B tcpsynbl | ||
.SH DESCRIPTION | ||
This tool shows the TCP SYN backlog size during SYN arrival as a histogram. | ||
This lets you see how close your applications are to hitting the backlog limit | ||
and dropping SYNs (causing performance issues with SYN retransmits), and is a | ||
measure of workload saturation. The histogram shown is measured at the time of | ||
SYN received, and a separate histogram is shown for each backlog limit. | ||
|
||
This works by tracing the tcp_v4_syn_recv_sock() and tcp_v6_syn_recv_sock() | ||
kernel functions using dynamic instrumentation. Since these functions may | ||
change in future kernels, this tool may need maintenance to keep working. | ||
|
||
Since this uses BPF, only the root user can use this tool. | ||
.SH REQUIREMENTS | ||
CONFIG_BPF and BCC. | ||
.SH EXAMPLES | ||
.TP | ||
Show the TCP SYN backlog as a histogram. | ||
# | ||
.B tcpsynbl | ||
.SH FIELDS | ||
.TP | ||
backlog | ||
The backlog size when a SYN was received. | ||
.TP | ||
count | ||
The number of times this backlog size was encountered. | ||
.TP | ||
distribution | ||
An ASCII visualization of the count column. | ||
.SH OVERHEAD | ||
Inbound SYNs should be relatively low compared to packets and other events, | ||
so the overhead of this tool is expected to be negligible. | ||
.SH SOURCE | ||
This originated as a bpftrace tool from the book "BPF Performance Tools", | ||
published by Addison Wesley (2019): | ||
.IP | ||
http:https://www.brendangregg.com/bpf-performance-tools-book.html | ||
.PP | ||
See the book for more documentation on this tool. | ||
.PP | ||
This version is in the BCC repository: | ||
.IP | ||
https://github.com/iovisor/bcc | ||
.PP | ||
Also look in the bcc distribution for a companion _examples.txt file | ||
containing example usage, output, and commentary for this tool. | ||
.SH OS | ||
Linux | ||
.SH STABILITY | ||
Unstable - in development. | ||
.SH AUTHOR | ||
Brendan Gregg | ||
.SH SEE ALSO | ||
tcptop(8) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,52 @@ | ||
#!/usr/bin/python | ||
# @lint-avoid-python-3-compatibility-imports | ||
# | ||
# tcpsynbl Show TCP SYN backlog. | ||
# For Linux, uses BCC, eBPF. Embedded C. | ||
# | ||
# Copyright (c) 2019 Brendan Gregg. | ||
# Licensed under the Apache License, Version 2.0 (the "License"). | ||
# This was originally created for the BPF Performance Tools book | ||
# published by Addison Wesley. ISBN-13: 9780136554820 | ||
# When copying or porting, include this comment. | ||
# | ||
# 03-Jul-2019 Brendan Gregg Ported from bpftrace to BCC. | ||
|
||
from __future__ import print_function | ||
from bcc import BPF | ||
from time import sleep | ||
|
||
# load BPF program | ||
b = BPF(text=""" | ||
#include <net/sock.h> | ||
typedef struct backlog_key { | ||
u32 backlog; | ||
u64 slot; | ||
} backlog_key_t; | ||
BPF_HISTOGRAM(dist, backlog_key_t); | ||
int do_entry(struct pt_regs *ctx) { | ||
struct sock *sk = (struct sock *)PT_REGS_PARM1(ctx); | ||
backlog_key_t key = {}; | ||
key.backlog = sk->sk_max_ack_backlog; | ||
key.slot = bpf_log2l(sk->sk_ack_backlog); | ||
dist.increment(key); | ||
return 0; | ||
}; | ||
""") | ||
b.attach_kprobe(event="tcp_v4_syn_recv_sock", fn_name="do_entry") | ||
b.attach_kprobe(event="tcp_v6_syn_recv_sock", fn_name="do_entry") | ||
|
||
print("Tracing SYN backlog size. Ctrl-C to end."); | ||
|
||
try: | ||
sleep(99999999) | ||
except KeyboardInterrupt: | ||
print() | ||
|
||
dist = b.get_table("dist") | ||
dist.print_log2_hist("backlog", "backlog_max") |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,20 @@ | ||
Demonstrations of tcpsynbl, the Linux BCC/eBPF version. | ||
|
||
|
||
This tool shows the TCP SYN backlog size during SYN arrival as a histogram. | ||
This lets you see how close your applications are to hitting the backlog limit | ||
and dropping SYNs (causing performance issues with SYN retransmits). For | ||
example: | ||
|
||
# ./tcpsynbl.py | ||
Tracing SYN backlog size. Ctrl-C to end. | ||
^C | ||
|
||
backlog_max = 500L | ||
backlog : count distribution | ||
0 -> 1 : 961 |****************************************| | ||
2 -> 3 : 1 | | | ||
|
||
This output shows that for the backlog limit of 500, there were 961 SYN | ||
arrival where the backlog was zero or one, and one accept where the backlog was | ||
two or three. This indicates that we are nowhere near this limit. |