[HN Gopher] A thorough introduction to bpftrace
       ___________________________________________________________________
        
       A thorough introduction to bpftrace
        
       Author : kiyanwang
       Score  : 51 points
       Date   : 2021-08-09 05:33 UTC (17 hours ago)
        
 (HTM) web link (www.brendangregg.com)
 (TXT) w3m dump (www.brendangregg.com)
        
       | suifbwish wrote:
       | What is the main advantage of this over native strace?
        
         | yakubin wrote:
         | bpftrace has lower overhead, because, thanks to BPF, it can
         | accumulate all the data needed in kernel and only send a
         | summary to userspace to be displayed. strace on the other hand
         | uses the ptrace(2) syscall to set a breakpoint on each syscall,
         | including the ones that you do not trace (when you filter calls
         | e.g.) and on each syscall data travels between kernel and
         | strace.
         | 
         | It's possible that in the future strace will use BPF as well to
         | lower its overhead.
         | 
         | bpftrace is also more versatile. You could use it to e.g.
         | collect stack traces for all the syscalls a program makes. You
         | can also attach actions to more things than just syscalls. You
         | can e.g. use kprobes to inject code into kernel functions which
         | aren't exported as syscalls.
        
         | 1vuio0pswjnm7 wrote:
         | bpftrace requires about 318 MB to install
         | 
         | strace requires less than 2 MB
         | 
         | Bigger is better :)
        
           | Sevan777 wrote:
           | Standalone binary the project publishes is 45MB. https://gith
           | ub.com/iovisor/bpftrace/releases/download/v0.13....
        
             | PennRobotics wrote:
             | I just tried two commands.
             | 
             | apt install bpftrace: needs 1,201 kB
             | 
             | apt remove strace: frees 1,792 kB
        
         | wmf wrote:
         | strace only traces system calls while bpftrace does much more.
         | Just looking at the first example, vfs_read isn't a system call
         | (read() may also operate on sockets or whatever) and strace
         | doesn't calculate histograms AFAIK.
        
           | tych0 wrote:
           | I use it a lot to figure out why things fail. For example,
           | what if you get an -EPERM from mount()? Was it denied by
           | seccomp, an LSM, because you don't own the user namespace
           | that owns your mount namespace?
           | 
           | strace will tell you it failed, but bpftrace can help
           | understand why.
           | 
           | Note that I said "help": bpftrace can tell you "this function
           | failed with EPERM", but e.g. ovl_fill_super() can fill with
           | EPERM for lots of different reasons. So it's a bit like
           | printf debugging. And you're SOL if the error is generated
           | within that function or from an inlined function :(
        
       | elteto wrote:
       | Title needs a [2019] tag.
        
       ___________________________________________________________________
       (page generated 2021-08-09 23:01 UTC)