{"id":213,"date":"2020-06-21T20:31:18","date_gmt":"2020-06-21T19:31:18","guid":{"rendered":"https:\/\/blog.thomarite.uk\/?p=213"},"modified":"2020-06-21T20:31:18","modified_gmt":"2020-06-21T19:31:18","slug":"bpf-basics","status":"publish","type":"post","link":"https:\/\/blog.thomarite.uk\/index.php\/2020\/06\/21\/bpf-basics\/","title":{"rendered":"BPF: basics"},"content":{"rendered":"\n

I had in my to-try list BPF. After reading this link<\/a>, I realised that it was quite straightforward to get a vagrant box with all the requirements.<\/p>\n\n\n\n

As per link recommends, watch the video<\/a>. I didnt know Brendan Gregg worked for Netflix and that Facebook was pushing very hard in BPF development. <\/p>\n\n\n\n

You can find all the documentation here<\/a>:<\/p>\n\n\n\n

So as per the main link:<\/p>\n\n\n\n

git clone https:\/\/github.com\/codeboten\/bpftracing.git<\/a> && cd bpftracing\nvagrant up<\/pre>\n\n\n\n
Once you have installed the vagrant box (it takes a while) you can “vagrant halt” and start again:<\/p>\n\n\n\n
~\/storage\/technology\/linux\/bpftracing master$ vagrant status\nCurrent machine states:\ndefault poweroff (virtualbox)\nThe VM is powered off. To restart the VM, simply run vagrant up<\/code>\n~\/storage\/technology\/linux\/bpftracing master$ vagrant up\nBringing machine 'default' up with 'virtualbox' provider\u2026\n==> default: Checking if box 'ubuntu\/bionic64' version '20200525.0.0' is up to date\u2026\n==> default: Clearing any previously set forwarded ports\u2026\n==> default: Clearing any previously set network interfaces\u2026\n==> default: Preparing network interfaces based on configuration\u2026\ndefault: Adapter 1: nat\n==> default: Forwarding ports\u2026\ndefault: 22 (guest) => 2222 (host) (adapter 1)\n==> default: Running 'pre-boot' VM customizations\u2026\n==> default: Booting VM\u2026\n==> default: Waiting for machine to boot. This may take a few minutes\u2026\ndefault: SSH address: 127.0.0.1:2222\ndefault: SSH username: vagrant\ndefault: SSH auth method: private key\n==> default: Machine booted and ready!\n==> default: Checking for guest additions in VM\u2026\ndefault: The guest additions on this VM do not match the installed version of\ndefault: VirtualBox! In most cases this is fine, but in rare cases it can\ndefault: prevent things such as shared folders from working properly. If you see\ndefault: shared folder errors, please make sure the guest additions within the\ndefault: virtual machine match the version of VirtualBox you have installed on\ndefault: your host and reload your VM.\ndefault:\ndefault: Guest Additions Version: 5.2.34\ndefault: VirtualBox Version: 6.1\n==> default: Mounting shared folders\u2026\ndefault: \/vagrant => \/home\/xxx\/storage\/technology\/linux\/bpftracing\n==> default: Machine already provisioned. Run vagrant provision<\/code> or use the --provision<\/code>\n==> default: flag to force provisioning. Provisioners marked to run always will still run.\n~\/storage\/technology\/linux\/bpftracing master$ vagrant ssh\nWelcome to Ubuntu 18.04.4 LTS (GNU\/Linux 4.15.0-106-generic x86_64)\nDocumentation: https:\/\/help.ubuntu.com\nManagement: https:\/\/landscape.canonical.com\nSupport: https:\/\/ubuntu.com\/advantage\nSystem information as of Sun Jun 21 19:25:26 UTC 2020\nSystem load: 0.35 Processes: 99\nUsage of \/: 32.2% of 9.63GB Users logged in: 0\nMemory usage: 12% IP address for enp0s3: 10.0.2.15\nSwap usage: 0%\n0 packages can be updated.\n0 updates are security updates.\nLast login: Sun Jun 21 19:22:37 2020 from 10.0.2.2\nvagrant@ubuntu-bionic:~$\nvagrant@ubuntu-bionic:~$ cd \/vagrant\/\nvagrant@ubuntu-bionic:\/vagrant$ ls\nMakefile Vagrantfile bpf_program.o monitor-exec\nREADME.md bpf_program.c loader.c ubuntu-bionic-18.04-cloudimg-console.log\nvagrant@ubuntu-bionic:\/vagrant$<\/pre>\n\n\n\n
You can find tools (under \/usr\/sbin)(already compiled and ready to use) or examples (under \/usr\/share\/doc\/bpfcc-tools\/examples)<\/p>\n\n\n\n
These are the tools you can find in the system:<\/p>\n\n\n\n
vagrant@ubuntu-bionic:~$ ls -ltr \/usr\/sbin | grep -i bpfcc\n-rwxr-xr-x 1 root root 3496 Nov 29 2017 reset-trace-bpfcc\n-rwxr-xr-x 1 root root 7105 Nov 29 2017 deadlock_detector.c-bpfcc\n-rwxr-xr-x 1 root root 9029 Mar 27 2018 zfsslower-bpfcc\n-rwxr-xr-x 1 root root 5131 Mar 27 2018 zfsdist-bpfcc\n-rwxr-xr-x 1 root root 8184 Mar 27 2018 xfsslower-bpfcc\n-rwxr-xr-x 1 root root 4431 Mar 27 2018 xfsdist-bpfcc\n-rwxr-xr-x 1 root root 6825 Mar 27 2018 wakeuptime-bpfcc\n-rwxr-xr-x 1 root root 2636 Mar 27 2018 vfsstat-bpfcc\n-rwxr-xr-x 1 root root 1177 Mar 27 2018 vfscount-bpfcc\n-rwxr-xr-x 1 root root 2978 Mar 27 2018 ttysnoop-bpfcc\n-rwxr-xr-x 1 root root 31977 Mar 27 2018 trace-bpfcc\n-rwxr-xr-x 1 root root 4159 Mar 27 2018 tplist-bpfcc\n-rwxr-xr-x 1 root root 17766 Mar 27 2018 tcptracer-bpfcc\n-rwxr-xr-x 1 root root 9327 Mar 27 2018 tcptop-bpfcc\n-rwxr-xr-x 1 root root 5631 Mar 27 2018 tcpretrans-bpfcc\n-rwxr-xr-x 1 root root 11996 Mar 27 2018 tcplife-bpfcc\n-rwxr-xr-x 1 root root 6858 Mar 27 2018 tcpconnlat-bpfcc\n-rwxr-xr-x 1 root root 6963 Mar 27 2018 tcpconnect-bpfcc\n-rwxr-xr-x 1 root root 5782 Mar 27 2018 tcpaccept-bpfcc\n-rwxr-xr-x 1 root root 12809 Mar 27 2018 syscount-bpfcc\n-rwxr-xr-x 1 root root 1231 Mar 27 2018 syncsnoop-bpfcc\n-rwxr-xr-x 1 root root 4560 Mar 27 2018 statsnoop-bpfcc\n-rwxr-xr-x 1 root root 15860 Mar 27 2018 stackcount-bpfcc\n-rwxr-xr-x 1 root root 6244 Mar 27 2018 sslsniff-bpfcc\n-rwxr-xr-x 1 root root 6277 Mar 27 2018 solisten-bpfcc\n-rwxr-xr-x 1 root root 4048 Mar 27 2018 softirqs-bpfcc\n-rwxr-xr-x 1 root root 3409 Mar 27 2018 slabratetop-bpfcc\n-rwxr-xr-x 1 root root 5643 Mar 27 2018 runqlen-bpfcc\n-rwxr-xr-x 1 root root 5998 Mar 27 2018 runqlat-bpfcc\n-rwxr-xr-x 1 root root 58 Mar 27 2018 rubystat-bpfcc\n-rwxr-xr-x 1 root root 60 Mar 27 2018 rubyobjnew-bpfcc\n-rwxr-xr-x 1 root root 56 Mar 27 2018 rubygc-bpfcc\n-rwxr-xr-x 1 root root 58 Mar 27 2018 rubyflow-bpfcc\n-rwxr-xr-x 1 root root 59 Mar 27 2018 rubycalls-bpfcc\n-rwxr-xr-x 1 root root 60 Mar 27 2018 pythonstat-bpfcc\n-rwxr-xr-x 1 root root 58 Mar 27 2018 pythongc-bpfcc\n-rwxr-xr-x 1 root root 60 Mar 27 2018 pythonflow-bpfcc\n-rwxr-xr-x 1 root root 61 Mar 27 2018 pythoncalls-bpfcc\n-rwxr-xr-x 1 root root 9831 Mar 27 2018 profile-bpfcc\n-rwxr-xr-x 1 root root 1139 Mar 27 2018 pidpersec-bpfcc\n-rwxr-xr-x 1 root root 57 Mar 27 2018 phpstat-bpfcc\n-rwxr-xr-x 1 root root 57 Mar 27 2018 phpflow-bpfcc\n-rwxr-xr-x 1 root root 58 Mar 27 2018 phpcalls-bpfcc\n-rwxr-xr-x 1 root root 4858 Mar 27 2018 opensnoop-bpfcc\n-rwxr-xr-x 1 root root 2337 Mar 27 2018 oomkill-bpfcc\n-rwxr-xr-x 1 root root 11141 Mar 27 2018 offwaketime-bpfcc\n-rwxr-xr-x 1 root root 10464 Mar 27 2018 offcputime-bpfcc\n-rwxr-xr-x 1 root root 58 Mar 27 2018 nodestat-bpfcc\n-rwxr-xr-x 1 root root 56 Mar 27 2018 nodegc-bpfcc\n-rwxr-xr-x 1 root root 9289 Mar 27 2018 nfsslower-bpfcc\n-rwxr-xr-x 1 root root 4587 Mar 27 2018 nfsdist-bpfcc\n-rwxr-xr-x 1 root root 3221 Mar 27 2018 mysqld_qslower-bpfcc\n-rwxr-xr-x 1 root root 12023 Mar 27 2018 mountsnoop-bpfcc\n-rwxr-xr-x 1 root root 17963 Mar 27 2018 memleak-bpfcc\n-rwxr-xr-x 1 root root 2262 Mar 27 2018 mdflush-bpfcc\n-rwxr-xr-x 1 root root 3429 Mar 27 2018 llcstat-bpfcc\n-rwxr-xr-x 1 root root 3295 Mar 27 2018 killsnoop-bpfcc\n-rwxr-xr-x 1 root root 61 Mar 27 2018 javathreads-bpfcc\n-rwxr-xr-x 1 root root 58 Mar 27 2018 javastat-bpfcc\n-rwxr-xr-x 1 root root 60 Mar 27 2018 javaobjnew-bpfcc\n-rwxr-xr-x 1 root root 56 Mar 27 2018 javagc-bpfcc\n-rwxr-xr-x 1 root root 58 Mar 27 2018 javaflow-bpfcc\n-rwxr-xr-x 1 root root 59 Mar 27 2018 javacalls-bpfcc\n-rwxr-xr-x 1 root root 5154 Mar 27 2018 hardirqs-bpfcc\n-rwxr-xr-x 1 root root 3852 Mar 27 2018 gethostlatency-bpfcc\n-rwxr-xr-x 1 root root 7124 Mar 27 2018 funcslower-bpfcc\n-rwxr-xr-x 1 root root 7442 Mar 27 2018 funclatency-bpfcc\n-rwxr-xr-x 1 root root 12448 Mar 27 2018 funccount-bpfcc\n-rwxr-xr-x 1 root root 5847 Mar 27 2018 filetop-bpfcc\n-rwxr-xr-x 1 root root 7235 Mar 27 2018 fileslower-bpfcc\n-rwxr-xr-x 1 root root 3718 Mar 27 2018 filelife-bpfcc\n-rwxr-xr-x 1 root root 9605 Mar 27 2018 ext4slower-bpfcc\n-rwxr-xr-x 1 root root 5674 Mar 27 2018 ext4dist-bpfcc\n-rwxr-xr-x 1 root root 5944 Mar 27 2018 execsnoop-bpfcc\n-rwxr-xr-x 1 root root 20036 Mar 27 2018 deadlock_detector-bpfcc\n-rwxr-xr-x 1 root root 3920 Mar 27 2018 dcstat-bpfcc\n-rwxr-xr-x 1 root root 4009 Mar 27 2018 dcsnoop-bpfcc\n-rwxr-xr-x 1 root root 3780 Mar 27 2018 dbstat-bpfcc\n-rwxr-xr-x 1 root root 7130 Mar 27 2018 dbslower-bpfcc\n-rwxr-xr-x 1 root root 12614 Mar 27 2018 cpuunclaimed-bpfcc\n-rwxr-xr-x 1 root root 4975 Mar 27 2018 cpudist-bpfcc\n-rwxr-xr-x 1 root root 57 Mar 27 2018 cobjnew-bpfcc\n-rwxr-xr-x 1 root root 4142 Mar 27 2018 capable-bpfcc\n-rwxr-xr-x 1 root root 6960 Mar 27 2018 cachetop-bpfcc\n-rwxr-xr-x 1 root root 4932 Mar 27 2018 cachestat-bpfcc\n-rwxr-xr-x 1 root root 9887 Mar 27 2018 btrfsslower-bpfcc\n-rwxr-xr-x 1 root root 6214 Mar 27 2018 btrfsdist-bpfcc\n-rwxr-xr-x 1 root root 2392 Mar 27 2018 bpflist-bpfcc\n-rwxr-xr-x 1 root root 1721 Mar 27 2018 bitesize-bpfcc\n-rwxr-xr-x 1 root root 6171 Mar 27 2018 biotop-bpfcc\n-rwxr-xr-x 1 root root 4869 Mar 27 2018 biosnoop-bpfcc\n-rwxr-xr-x 1 root root 4023 Mar 27 2018 biolatency-bpfcc\n-rwxr-xr-x 1 root root 1567 Mar 27 2018 bashreadline-bpfcc\n-rwxr-xr-x 1 root root 33534 Mar 27 2018 argdist-bpfcc\nvagrant@ubuntu-bionic:~$<\/pre>\n\n\n\n
You can run them like this:<\/p>\n\n\n\n
root@ubuntu-bionic:\/# cpudist-bpfcc\nTracing on-CPU time\u2026 Hit Ctrl-C to end.\n^C\nusecs : count distribution\n0 -> 1 : 4 | |\n2 -> 3 : 0 | |\n4 -> 7 : 33 |* |\n8 -> 15 : 24 | |\n16 -> 31 : 49 |* |\n32 -> 63 : 74 |** |\n64 -> 127 : 161 |* | 128 -> 255 : 101 |<\/strong><\/em> |\n256 -> 511 : 76 |<\/strong> |\n512 -> 1023 : 116 |* | 1024 -> 2047 : 64 |** | 2048 -> 4095 : 178 |<\/em>* | 4096 -> 8191 : 558 | |\n8192 -> 16383 : 191 |<\/em> |\n16384 -> 32767 : 288 | | 32768 -> 65535 : 338 |<\/strong><\/em><\/strong> |\n65536 -> 131071 : 756 |* |\n131072 -> 262143 : 1025 || 262144 -> 524287 : 950 |<\/strong><\/em><\/strong><\/em>*** |\nroot@ubuntu-bionic:\/#<\/pre>\n\n\n\n
This link<\/a> is a bit old (you need to add -bpfcc to all commands) but I think it can give you some more details for some tools.<\/p>\n\n\n\n
In general, this is quite beyond my knowledge. But I would like to be able to set it up in Debian and obviously use it.<\/p>\n","protected":false},"excerpt":{"rendered":"
I had in my to-try list BPF. After reading this link, I realised that it was quite straightforward to get a vagrant box with all the requirements. As per link recommends, watch the video. I didnt know Brendan Gregg worked for Netflix and that Facebook was pushing very hard in BPF development. You can find … Continue reading “BPF: basics”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-213","post","type-post","status-publish","format-standard","hentry","category-unix"],"_links":{"self":[{"href":"https:\/\/blog.thomarite.uk\/index.php\/wp-json\/wp\/v2\/posts\/213","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.thomarite.uk\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.thomarite.uk\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.thomarite.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.thomarite.uk\/index.php\/wp-json\/wp\/v2\/comments?post=213"}],"version-history":[{"count":1,"href":"https:\/\/blog.thomarite.uk\/index.php\/wp-json\/wp\/v2\/posts\/213\/revisions"}],"predecessor-version":[{"id":214,"href":"https:\/\/blog.thomarite.uk\/index.php\/wp-json\/wp\/v2\/posts\/213\/revisions\/214"}],"wp:attachment":[{"href":"https:\/\/blog.thomarite.uk\/index.php\/wp-json\/wp\/v2\/media?parent=213"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.thomarite.uk\/index.php\/wp-json\/wp\/v2\/categories?post=213"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.thomarite.uk\/index.php\/wp-json\/wp\/v2\/tags?post=213"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}