From 5eee5ffad76a8aa7189b66341eec2aa2ed86f717 Mon Sep 17 00:00:00 2001 From: Junli Ou Date: Sat, 13 Aug 2016 17:12:45 +0800 Subject: [PATCH] killsnoop: use current time replace timestamp and default output --- man/man8/killsnoop.8 | 13 +++------- tools/killsnoop.py | 49 ++++++------------------------------- tools/killsnoop_example.txt | 16 ++++++------ 3 files changed, 17 insertions(+), 61 deletions(-) diff --git a/man/man8/killsnoop.8 b/man/man8/killsnoop.8 index 72dd45a30025..b7048ed75173 100644 --- a/man/man8/killsnoop.8 +++ b/man/man8/killsnoop.8 @@ -2,7 +2,7 @@ .SH NAME killsnoop \- Trace signals issued by the kill() syscall. Uses Linux eBPF/bcc. .SH SYNOPSIS -.B killsnoop [\-h] [\-t] [\-x] [-p PID] +.B killsnoop [\-h] [\-x] [-p PID] .SH DESCRIPTION killsnoop traces the kill() syscall, to show signals sent via this method. This may be useful to troubleshoot failing applications, where an unknown mechanism @@ -23,9 +23,6 @@ CONFIG_BPF and bcc. \-h Print usage message. .TP -\-t -Include a timestamp column. -.TP \-x Only print failed kill() syscalls. .TP @@ -37,10 +34,6 @@ Trace all kill() syscalls: # .B killsnoop .TP -Trace all kill() syscalls, and include timestamps: -# -.B killsnoop \-t -.TP Trace only kill() syscalls that failed: # .B killsnoop \-x @@ -50,8 +43,8 @@ Trace PID 181 only: .B killsnoop \-p 181 .SH FIELDS .TP -TIME(s) -Time of the call, in seconds. +TIME +Time of the kill call. .TP PID Source process ID diff --git a/tools/killsnoop.py b/tools/killsnoop.py index 202eae50b2a8..230231602630 100755 --- a/tools/killsnoop.py +++ b/tools/killsnoop.py @@ -4,7 +4,7 @@ # killsnoop Trace signals issued by the kill() syscall. # For Linux, uses BCC, eBPF. Embedded C. # -# USAGE: killsnoop [-h] [-t] [-x] [-p PID] +# USAGE: killsnoop [-h] [-x] [-p PID] # # Copyright (c) 2015 Brendan Gregg. # Licensed under the Apache License, Version 2.0 (the "License") @@ -15,12 +15,12 @@ from __future__ import print_function from bcc import BPF import argparse +from time import strftime import ctypes as ct # arguments examples = """examples: ./killsnoop # trace all kill() signals - ./killsnoop -t # include timestamps ./killsnoop -x # only show failed kills ./killsnoop -p 181 # only trace PID 181 """ @@ -28,8 +28,6 @@ description="Trace signals issued by the kill() syscall", formatter_class=argparse.RawDescriptionHelpFormatter, epilog=examples) -parser.add_argument("-t", "--timestamp", action="store_true", - help="include timestamp on output") parser.add_argument("-x", "--failed", action="store_true", help="only show failed kill syscalls") parser.add_argument("-p", "--pid", @@ -44,7 +42,6 @@ struct val_t { u64 pid; - u64 ts; int sig; int tpid; char comm[TASK_COMM_LEN]; @@ -55,8 +52,6 @@ u64 tpid; int sig; int ret; - u64 ts; - u64 delta; char comm[TASK_COMM_LEN]; }; @@ -71,7 +66,6 @@ FILTER if (bpf_get_current_comm(&val.comm, sizeof(val.comm)) == 0) { val.pid = bpf_get_current_pid_tgid(); - val.ts = bpf_ktime_get_ns(); val.tpid = tpid; val.sig = sig; infotmp.update(&pid, &val); @@ -85,7 +79,6 @@ struct data_t data = {}; struct val_t *valp; u32 pid = bpf_get_current_pid_tgid(); - u64 tsp = bpf_ktime_get_ns(); valp = infotmp.lookup(&pid); if (valp == 0) { @@ -95,8 +88,6 @@ bpf_probe_read(&data.comm, sizeof(data.comm), valp->comm); data.pid = pid; - data.delta = tsp - valp->ts; - data.ts = tsp / 1000; data.tpid = valp->tpid; data.ret = PT_REGS_RC(ctx); data.sig = valp->sig; @@ -126,47 +117,21 @@ class Data(ct.Structure): ("tpid", ct.c_ulonglong), ("sig", ct.c_int), ("ret", ct.c_int), - ("ts", ct.c_ulonglong), - ("delta", ct.c_ulonglong), ("comm", ct.c_char * TASK_COMM_LEN) ] -start_ts = 0 -prev_ts = 0 -delta = 0 - # header -if args.timestamp: - print("%-14s" % ("TIME(s)"), end="") -print("%-6s %-16s %-4s %-6s %s" % ("PID", "COMM", "SIG", "TPID", "RESULT")) +print("%-9s %-6s %-16s %-4s %-6s %s" % ( + "TIME", "PID", "COMM", "SIG", "TPID", "RESULT")) # process event def print_event(cpu, data, size): event = ct.cast(data, ct.POINTER(Data)).contents - global start_ts - global prev_ts - global delta - - if start_ts == 0: - prev_ts = start_ts - - if start_ts == 1: - delta = float(delta) + (event.ts - prev_ts) - - if (args.failed and (event.ret >= 0)): - start_ts = 1 - prev_ts = event.ts - return - - # print columns - if args.timestamp: - print("%-14.9f" % (delta / 1000000), end="") - print("%-6d %-16s %-4d %-6d %d" % (event.pid, event.comm, event.sig, - event.tpid, event.ret)) + if (args.failed and (event.ret >= 0)): return - prev_ts = event.ts - start_ts = 1 + print("%-9s %-6d %-16s %-4d %-6d %d" % (strftime("%H:%M:%S"), + event.pid, event.comm, event.sig, event.tpid, event.ret)) # loop with callback to print_event b["events"].open_perf_buffer(print_event) diff --git a/tools/killsnoop_example.txt b/tools/killsnoop_example.txt index 1f49b0f42a78..29d56b0a8937 100644 --- a/tools/killsnoop_example.txt +++ b/tools/killsnoop_example.txt @@ -4,13 +4,13 @@ Demonstrations of killsnoop, the Linux eBPF/bcc version. This traces signals sent via the kill() syscall. For example: # ./killsnoop -PID COMM SIG TPID RESULT -17064 bash 9 27682 0 -17064 bash 9 27682 -3 -17064 bash 0 17064 0 +TIME PID COMM SIG TPID RESULT +12:10:51 13967 bash 9 13885 0 +12:11:34 13967 bash 9 1024 -3 +12:11:41 815 systemd-udevd 15 14076 0 -The first line showed a SIGKILL (9) sent from PID 17064 (a bash shell) to -PID 27682. The result, 0, means success. +The first line showed a SIGKILL (9) sent from PID 13967 (a bash shell) to +PID 13885. The result, 0, means success. The second line showed the same signal sent, this time resulting in a -3 (ESRCH: no such process). @@ -19,18 +19,16 @@ The second line showed the same signal sent, this time resulting in a -3 USAGE message: # ./killsnoop -h -usage: killsnoop [-h] [-t] [-x] [-p PID] +usage: killsnoop [-h] [-x] [-p PID] Trace signals issued by the kill() syscall optional arguments: -h, --help show this help message and exit - -t, --timestamp include timestamp on output -x, --failed only show failed kill syscalls -p PID, --pid PID trace this PID only examples: ./killsnoop # trace all kill() signals - ./killsnoop -t # include timestamps ./killsnoop -x # only show failed kills ./killsnoop -p 181 # only trace PID 181