Replace use of trace pipe with bpf_perf_event

[markdrayton]

BCC tools that read data from the trace pipe are often confused when they come across unexpected output from other tracepoints. Where possible, we should replace use of the trace pipe with perf_event_event. It looks like only 5 scripts still use it (via the trace_fields Python function):

$ grep trace_fields tools/*.py                                                                                          
tools/dcsnoop.py:    (task, pid, cpu, flags, ts, msg) = b.trace_fields()
tools/execsnoop.py:    (task, pid, cpu, flags, ts, msg) = b.trace_fields()
tools/fileslower.py:    (task, pid, cpu, flags, ts, msg) = b.trace_fields()
tools/memleak.py:                print(bpf_program.trace_fields())
tools/stacksnoop.py:    (task, pid, cpu, flags, ts, msg) = b.trace_fields()

[brendangregg]

Now down to 2:

$ grep trace_fields tools/*.py    
tools/dcsnoop.py:    (task, pid, cpu, flags, ts, msg) = b.trace_fields()
tools/memleak.py:                print(bpf_program.trace_fields())

[markdrayton]

I'm not sure it makes sense to convert memleak.py as it only uses the trace pipe to print information. Nothing's parsing the output and converting the script to use the perf system will add a good chunk more code.

[goldshtn]

Yep, and besides the printing isn't actually useful for anything but debugging the script itself, because of the immense overhead of these printouts.

[markdrayton]

Perfect. Let's call this one done then.