Re: [PATCH RFC v4 net-next 25/26] samples: bpf: counting eBPF example in C
From: Brendan Gregg <hidden>
Date: 2014-08-14 22:13:56
Also in:
linux-api, lkml
On Wed, Aug 13, 2014 at 12:57 AM, Alexei Starovoitov [off-list ref] wrote:
this example has two probes in C that use two different maps.
1st probe is the similar to dropmon.c. It attaches to kfree_skb tracepoint and
count number of packet drops at different locations
2nd probe attaches to kprobe/sys_write and computes a histogram of different
write sizes
Usage:
$ sudo ex2
Should see:
writing bpf-5 -> /sys/kernel/debug/tracing/events/skb/kfree_skb/filter
writing bpf-8 -> /sys/kernel/debug/tracing/events/kprobes/sys_write/filter
location 0xffffffff816efc67 count 1
location 0xffffffff815d8030 count 1
location 0xffffffff816efc67 count 3
location 0xffffffff815d8030 count 4
location 0xffffffff816efc67 count 9
syscall write() stats
byte_size : count distribution
1 -> 1 : 3141 |**** |
2 -> 3 : 2 | |
4 -> 7 : 14 | |
8 -> 15 : 3268 |***** |
16 -> 31 : 732 | |
32 -> 63 : 20042 |************************************* |
64 -> 127 : 12154 |********************** |
128 -> 255 : 2215 |*** |
256 -> 511 : 9 | |
512 -> 1023 : 0 | |
1024 -> 2047 : 1 | |This is pretty awesome. Given that this is tracing two tracepoints at once, I'd like to see a similar example where time is stored on the first tracepoint, retrieved on the second for a delta calculation, then presented with a similar histogram as seen above. Brendan