You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
66 lines
2.1 KiB
66 lines
2.1 KiB
Demonstrations of bpflist. |
|
|
|
|
|
bpflist displays information on running BPF programs and optionally also |
|
prints open kprobes and uprobes. It is used to understand which BPF programs |
|
are currently running on the system. For example: |
|
|
|
# bpflist |
|
PID COMM TYPE COUNT |
|
4058 fileslower prog 4 |
|
4058 fileslower map 2 |
|
4106 bashreadline map 1 |
|
4106 bashreadline prog 1 |
|
|
|
From the output above, the fileslower and bashreadline tools are running. |
|
fileslower has installed 4 BPF programs (functions) and has opened 2 BPF maps |
|
(such as hashes, histograms, stack trace tables, and so on). |
|
|
|
In verbose mode, bpflist also counts the number of kprobes and uprobes opened |
|
by the process. This information is obtained heuristically: bcc-based tools |
|
include the process id in the name of the probe. For example: |
|
|
|
# bpflist -v |
|
PID COMM TYPE COUNT |
|
4058 fileslower prog 4 |
|
4058 fileslower kprobe 4 |
|
4058 fileslower map 2 |
|
4106 bashreadline uprobe 1 |
|
4106 bashreadline prog 1 |
|
4106 bashreadline map 1 |
|
|
|
In double-verbose mode, the probe definitions are also displayed: |
|
|
|
# bpflist -vv |
|
open kprobes: |
|
p:kprobes/p___vfs_read_bcc_4058 __vfs_read |
|
r:kprobes/r___vfs_read_bcc_4058 __vfs_read |
|
p:kprobes/p___vfs_write_bcc_4058 __vfs_write |
|
r:kprobes/r___vfs_write_bcc_4058 __vfs_write |
|
|
|
open uprobes: |
|
r:uprobes/r__bin_bash_0xa4dd0_bcc_4106 /bin/bash:0x00000000000a4dd0 |
|
|
|
PID COMM TYPE COUNT |
|
4058 fileslower prog 4 |
|
4058 fileslower kprobe 4 |
|
4058 fileslower map 2 |
|
4106 bashreadline uprobe 1 |
|
4106 bashreadline prog 1 |
|
4106 bashreadline map 1 |
|
|
|
|
|
USAGE: |
|
# bpflist -h |
|
usage: bpflist.py [-h] [-v] |
|
|
|
Display processes currently using BPF programs and maps |
|
|
|
optional arguments: |
|
-h, --help show this help message and exit |
|
-v, --verbosity count and display kprobes/uprobes as well |
|
|
|
examples: |
|
bpflist # display all processes currently using BPF |
|
bpflist -v # also count kprobes/uprobes |
|
bpflist -vv # display kprobes/uprobes and count them
|
|
|