tools/execsnoop: display which cpu the processes running on

[markyangcc]

In SMP systems, knowing which specific CPU a process is running on can be useful for troubleshooting.

Test it,

[root@anylinux ~]# taskset -c 0 sleep 100 &
[1] 2199347
[root@anylinux ~]# taskset -c 1 sleep 100 &
[2] 2199348

Now, execsnoop with '-C' option displays that one sleep process is running on CPU 0, the other is running on CPU 1, as expected.

[root@anylinux ~]# /usr/share/bcc/tools/execsnoop -C
PCOMM            PID     PPID    CPU  RET ARGS
taskset          2199347 2199222 0      0 /usr/bin/taskset -c 0 sleep 100
sleep            2199347 2199222 0      0 /usr/bin/sleep 100
taskset          2199348 2199222 4      0 /usr/bin/taskset -c 1 sleep 100
sleep            2199348 2199222 1      0 /usr/bin/sleep 100

[yonghong-song]

Which kernel version you are testing? I checked latest upstream and 5.19, the field name for 'task' is 'on_cpu' and not 'cpu'. Please ensure your change works for all supported kernels (from e.g. 4.11 to recent kernels).

[markyangcc]

Yes, 'cpu' filed was changed on recent kernels. It was move back to 'thread_info' since linux 5.16
Link: torvalds/linux@bcf9033e5449
Now, BTF filed check or buildtime filed check is added to handle this change.

[yonghong-song]

can we add this 'cpu' display under an option (e.g., '-c')? The reason is in most cases, the value will be 0 and we should not display them. People can use -c if they have pinned-to-cpu task and they want to monitor them.

[yonghong-song]

I would like CPU column after 'PPID' and before 'RET' and this confirms to most other bcc tools where PCOMM/PID/PPID is displayed earlier in columns.

[markyangcc]

Thanks reviewing, I rearranged the CPU column display position. Now it's after 'PPID' and before 'RET'.