### Install BCC Example Files Source: https://github.com/iovisor/bcc/blob/master/examples/networking/neighbor_sharing/CMakeLists.txt Installs example files like README.txt and simulation.py to the share/bcc/examples/networking/neighbor_sharing directory. ```cmake set(EXAMPLE_FILES README.txt simulation.py tc_neighbor_sharing.c) install(FILES ${EXAMPLE_FILES} DESTINATION share/bcc/examples/networking/neighbor_sharing) ``` -------------------------------- ### C++ Example Build Configuration Source: https://github.com/iovisor/bcc/blob/master/examples/cpp/CMakeLists.txt Configures the build process for C++ examples, including finding source files and linking against BCC libraries. Installation is optional. ```cmake option(INSTALL_CPP_EXAMPLES "Install C++ examples. Those binaries are statically linked and can take plenty of disk space" OFF) ``` ```cmake file(GLOB EXAMPLES *.cc) foreach(EXAMPLE ${EXAMPLES}) get_filename_component(NAME ${EXAMPLE} NAME_WE) add_executable(${NAME} ${EXAMPLE}) if(NOT CMAKE_USE_LIBBPF_PACKAGE) target_link_libraries(${NAME} bcc-static) else() target_link_libraries(${NAME} bcc-shared) endif() if(INSTALL_CPP_EXAMPLES) install (TARGETS ${NAME} DESTINATION share/bcc/examples/cpp) endif(INSTALL_CPP_EXAMPLES) endforeach() ``` -------------------------------- ### Install BCC Example Programs Source: https://github.com/iovisor/bcc/blob/master/examples/networking/neighbor_sharing/CMakeLists.txt Installs executable example programs, such as tc_neighbor_sharing.py, to the share/bcc/examples/networking/neighbor_sharing directory. ```cmake set(EXAMPLE_PROGRAMS tc_neighbor_sharing.py) install(PROGRAMS ${EXAMPLE_PROGRAMS} DESTINATION share/bcc/examples/networking/neighbor_sharing) ``` -------------------------------- ### Test BCC Installation with Lua Example Source: https://github.com/iovisor/bcc/blob/master/src/lua/README.md Run a sample Lua BPF program to verify that libbcc is installed and functioning correctly. ```bash $ sudo src/lua/bcc-probe examples/lua/task_switch.lua ``` -------------------------------- ### Setup LLVM with BPF Support Source: https://github.com/iovisor/bcc/blob/master/scripts/README.md Execute this command to download and compile LLVM with BPF support. The resulting libraries are installed in /opt/local/llvm. ```bash [root@bpf-demo ~]# bpf-llvm-setup Cloning into 'llvm'... ``` -------------------------------- ### Install BCC on Ubuntu (Binary - iovisor Packages) Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Installs BCC tools and examples from the iovisor PPA for Ubuntu. This provides up-to-date packages. Ensure your system's sources.list.d is configured correctly. ```bash sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 4052245BD4284CDD echo "deb https://repo.iovisor.org/apt/$(lsb_release -cs) $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/iovisor.list sudo apt-get update sudo apt-get install bcc-tools libbcc-examples linux-headers-$(uname -r) ``` -------------------------------- ### Setup Script for Tunnel Monitor Source: https://github.com/iovisor/bcc/blob/master/examples/networking/tunnel_monitor/README.md Runs the setup script to clone dependencies and install UI components. Requires nodejs and npm. ```bash [user@localhost tunnel_monitor]$ ./setup.sh Cloning into 'chord-transitions'... remote: Counting objects: 294, done. ... jquery#2.1.4 bower_components/jquery modernizr#2.8.3 bower_components/modernizr fastclick#1.0.6 bower_components/fastclick [user@localhost tunnel_monitor]$ ``` -------------------------------- ### Run BCC Examples Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Demonstrates how to execute BCC Python scripts, either directly or by navigating to the examples directory. ```bash hello_world.py ``` ```bash cd /usr/share/bcc/examples ./hello_world.py ./tracing/bitehist.py cd /usr/share/bcc/tools ./bitesize ``` -------------------------------- ### Profile Output Example Source: https://github.com/iovisor/bcc/blob/master/tools/profile_example.txt Example output from the ./profile tool showing sampled stack traces. ```text Sampling at 49 Hertz of all threads by user stack... Hit Ctrl-C to end. ^C [unknown] [unknown] - dd (2931) 1 [unknown] [unknown] - dd (2931) 1 [unknown] [unknown] - dd (2931) 1 [unknown] [unknown] - dd (2931) 1 [unknown] [unknown] - dd (2931) 1 func_b main __libc_start_main [unknown] - func_ab (2930) 1 [unknown] - dd (2931) 1 [unknown] - dd (2931) 1 func_a main __libc_start_main [unknown] - func_ab (2930) 3 __write [unknown] - dd (2931) 3 func_a main __libc_start_main [unknown] - func_ab (2930) 4 func_b main __libc_start_main [unknown] - func_ab (2930) 7 - swapper/6 (0) 10 func_b main __libc_start_main [unknown] - func_ab (2930) 10 __write - dd (2931) 10 func_a main __libc_start_main [unknown] - func_ab (2930) 11 read - dd (2931) 12 read [unknown] - dd (2931) 14 ``` -------------------------------- ### Setup Kernel DebugFS Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Installs kernel development headers matching the running kernel and mounts the debugfs filesystem, which is required for BCC tools to function. ```bash sudo yum -y install kernel-devel-$(uname -r) sudo mount -t debugfs debugfs /sys/kernel/debug ``` -------------------------------- ### Install BCC on openSUSE Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Refresh repositories and install BCC tools and examples using zypper on openSUSE Leap 42.2 or later, and Tumbleweed. BCC is available in the official repositories. ```bash sudo zypper ref sudo zypper in bcc-tools bcc-examples ``` -------------------------------- ### Install BCC on Ubuntu (Binary - Upstream Nightly) Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Installs BCC tools and examples from upstream nightly builds for Ubuntu. Replace 'xenial' with your Ubuntu version (e.g., 'artful', 'bionic'). ```bash echo "deb [trusted=yes] https://repo.iovisor.org/apt/xenial xenial-nightly main" | sudo tee /etc/apt/sources.list.d/iovisor.list sudo apt-get update sudo apt-get install bcc-tools libbcc-examples linux-headers-$(uname -r) ``` -------------------------------- ### Run VLAN Learning Example Source: https://github.com/iovisor/bcc/blob/master/examples/networking/vlan_learning/README.txt Execute the VLAN learning example script with root privileges. This command initiates the BPF program for traffic management. ```bash sudo /path/to/vlan_learning/vlan_learning.py ``` -------------------------------- ### Install LuaJIT Source: https://github.com/iovisor/bcc/blob/master/src/lua/README.md Install LuaJIT and its development files, required for the Lua frontend of BCC. ```bash $ sudo apt-get install luajit luajit-5.1-dev ``` -------------------------------- ### Install snapcraft Source: https://github.com/iovisor/bcc/blob/master/snap/README.md Install snapcraft to manage snaps. This command is typically run on Ubuntu. ```bash sudo snap install snapcraft --classic ``` -------------------------------- ### Start a Task on a Specific NUMA Node Source: https://github.com/iovisor/bcc/blob/master/tools/numasched_example.txt Initiate a process, such as 'yes', and bind it to a specific CPU core associated with a NUMA node using 'taskset'. This example binds the 'yes' command to CPU 1, which is typically part of NUMA node 0. ```bash taskset -c 1 yes >/dev/null ``` -------------------------------- ### Install Clang 3.7.1 Binaries Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Downloads and installs pre-built binaries for Clang and LLVM version 3.7.1. This is an alternative to building from source. ```bash wget http://releases.llvm.org/3.7.1/clang+llvm-3.7.1-x86_64-fedora22.tar.xz tar xf clang* (cd clang* && sudo cp -R * /usr/local/) ``` -------------------------------- ### runqslower output example Source: https://github.com/iovisor/bcc/blob/master/libbpf-tools/runqslower_example.txt Example output from runqslower, showing timestamp, command, thread ID, and latency in microseconds for tasks exceeding the default threshold. ```text TIME COMM TID LAT(us) 04:16:32 cc1 12924 12739 04:16:32 sh 13640 12118 04:16:32 make 13639 12730 04:16:32 bash 13655 12047 04:16:32 bash 13657 12744 04:16:32 bash 13656 12880 04:16:32 sh 13660 10846 04:16:32 gcc 13663 12681 04:16:32 make 13668 10814 04:16:32 make 13670 12988 04:16:32 gcc 13677 11770 04:16:32 gcc 13678 23519 04:16:32 as 12999 20541 [...] ``` -------------------------------- ### Install BCC Executable Source: https://github.com/iovisor/bcc/blob/master/src/lua/CMakeLists.txt Installs the compiled BCC executable to the 'bin' directory at runtime. ```cmake install(TARGETS bcc-lua RUNTIME DESTINATION bin) ``` -------------------------------- ### Bindsnoop example: trace all TCP binds Source: https://github.com/iovisor/bcc/blob/master/tools/bindsnoop_example.txt Example command to trace all TCP bind() calls on the system. ```bash ./bindsnoop ``` -------------------------------- ### Example of human-readable output from xfsslower Source: https://github.com/iovisor/bcc/blob/master/tools/xfsslower_example.txt This example shows the default human-readable output format, detailing XFS operations, their type, size, offset, latency, and associated filename. ```text TIME COMM PID T BYTES OFF_KB LAT(ms) FILENAME 06:29:43 ls 9291 O 0 0 0.00 bench 06:29:47 cat 9361 O 0 0 0.00 date.txt 06:29:47 cat 9361 R 29 0 0.01 date.txt 06:29:47 cat 9361 R 0 0 0.00 date.txt 06:29:50 bash 20500 O 0 0 0.00 bench 06:29:50 bash 20500 O 0 0 0.00 bench 06:29:50 bash 20500 O 0 0 0.00 bench 06:29:50 bash 9431 O 0 0 0.00 bench 06:29:50 bash 9432 O 0 0 0.00 bench 06:29:50 bash 9456 O 0 0 0.00 newdate.txt 06:29:50 date 9456 W 29 0 0.01 newdate.txt 06:29:53 cksum 9503 O 0 0 0.00 data1 06:29:53 cksum 9503 R 65536 0 0.06 data1 06:29:53 cksum 9503 R 65536 64 0.01 data1 06:29:53 cksum 9503 R 65536 128 0.02 data1 06:29:53 cksum 9503 R 65536 192 0.01 data1 06:29:53 cksum 9503 R 65536 256 0.01 data1 06:29:53 cksum 9503 R 65536 320 0.01 data1 06:29:53 cksum 9503 R 65536 384 0.01 data1 06:29:53 cksum 9503 R 65536 448 0.04 data1 06:29:53 cksum 9503 R 65536 512 0.01 data1 06:29:53 cksum 9503 R 65536 576 0.02 data1 06:29:53 cksum 9503 R 65536 640 0.01 data1 06:29:53 cksum 9503 R 65536 704 0.01 data1 06:29:53 cksum 9503 R 65536 768 0.01 data1 06:29:53 cksum 9503 R 65536 832 0.01 data1 06:29:53 cksum 9503 R 65536 896 0.01 data1 06:29:53 cksum 9503 R 65536 960 0.01 data1 06:29:53 cksum 9503 R 65536 1024 0.01 data1 06:29:53 cksum 9503 R 65536 1088 0.02 data1 06:29:53 cksum 9503 R 65536 1152 0.01 data1 06:29:53 cksum 9503 R 65536 1216 0.01 data1 [...] ``` -------------------------------- ### Cachetop Output Example Source: https://github.com/iovisor/bcc/blob/master/tools/cachetop_example.txt An example of the output generated by cachetop.py, showing page cache statistics for various processes. ```text 13:01:01 Buffers MB: 76 / Cached MB: 114 / Sort: HITS / Order: ascending PID UID CMD HITS MISSES DIRTIES READ_HIT% WRITE_HIT% 1 root systemd 2 0 0 100.0% 0.0% 680 root vminfo 3 4 2 14.3% 42.9% 567 syslog rs:main Q:Reg 10 4 2 57.1% 21.4% 986 root kworker/u2:2 10 2457 4 0.2% 99.5% 988 root kworker/u2:2 10 9 4 31.6% 36.8% 877 vagrant systemd 18 4 2 72.7% 13.6% 983 root python 148 3 143 3.3% 1.3% 981 root strace 419 3 143 65.4% 0.5% 544 messageb dbus-daemon 455 371 454 0.1% 0.4% 243 root jbd2/dm-0-8 457 371 454 0.4% 0.4% 985 root (mount) 560 2457 4 18.4% 81.4% 987 root systemd-udevd 566 9 4 97.7% 1.2% 988 root systemd-cgroups 569 9 4 97.8% 1.2% 986 root modprobe 578 9 4 97.8% 1.2% 287 root systemd-journal 598 371 454 14.9% 0.3% 985 root mount 692 2457 4 21.8% 78.0% 984 vagrant find 9529 2457 4 79.5% 20.5% ``` -------------------------------- ### Bindsnoop example: trace with wider columns Source: https://github.com/iovisor/bcc/blob/master/tools/bindsnoop_example.txt Example command to run bindsnoop with the -w option, which widens the output columns to accommodate IPv6 addresses. ```bash ./bindsnoop -w ``` -------------------------------- ### Install BCC on Fedora 30+ Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Use this command to install BCC binaries from the standard Fedora repository. Ensure your system is up-to-date. ```bash sudo dnf install bcc ``` -------------------------------- ### Example Output of vfsreadlat.py Source: https://github.com/iovisor/bcc/blob/master/docs/tutorial_bcc_python_developer.md Example output showing latency distribution for disk I/O operations, measured in microseconds. Displays counts and a visual distribution. ```text # ./vfsreadlat.py 1 Tracing... Hit Ctrl-C to end. usecs : count distribution 0 -> 1 : 0 | | 2 -> 3 : 2 |*********** | 4 -> 7 : 7 |****************************************| 8 -> 15 : 4 |********************** | usecs : count distribution 0 -> 1 : 29 |****************************************| 2 -> 3 : 28 |************************************** | 4 -> 7 : 4 |***** | 8 -> 15 : 8 |*********** | 16 -> 31 : 0 | | 32 -> 63 : 0 | | 64 -> 127 : 0 | | 128 -> 255 : 0 | | 256 -> 511 : 2 |** | 512 -> 1023 : 0 | | 1024 -> 2047 : 0 | | 2048 -> 4095 : 0 | | 4096 -> 8191 : 4 |***** | 8192 -> 16383 : 6 |******** | 16384 -> 32767 : 9 |************ | 32768 -> 65535 : 6 |******** | 65536 -> 131071 : 2 |** | usecs : count distribution 0 -> 1 : 11 |****************************************| 2 -> 3 : 2 |******* | 4 -> 7 : 10 |************************************ | 8 -> 15 : 8 |***************************** | 16 -> 31 : 1 |*** | 32 -> 63 : 2 |******* | ... ``` -------------------------------- ### ustat examples Source: https://github.com/iovisor/bcc/blob/master/tools/javastat_example.txt Illustrative examples of ustat command-line usage, demonstrating basic execution, screen clearing control, language-specific tracing, interval settings, and timed output. ```bash ./ustat # stats for all languages, 1 second refresh ``` ```bash ./ustat -C # don't clear the screen ``` ```bash ./ustat -l java # Java processes only ``` ```bash ./ustat 5 # 5 second summaries ``` ```bash ./ustat 5 10 # 5 second summaries, 10 times only ``` -------------------------------- ### Start USDT Sample Application Source: https://github.com/iovisor/bcc/blob/master/examples/usdt_sample/usdt_sample.md Execute the usdt_sample_app1 with specified parameters. Note the PID for subsequent analysis. ```bash $ examples/usdt_sample/build_clang/usdt_sample_app1/usdt_sample_app1 "usdt" 1 30 10 1 50 Applying the following parameters: Input prefix: usdt. Input range: [1, 30]. Calls Per Second: 10. Latency range: [1, 50] ms. You can now run the bcc scripts, see usdt_sample.md for examples. pid: 2439214 Press ctrl-c to exit. ``` -------------------------------- ### Example of CSV output from xfsslower Source: https://github.com/iovisor/bcc/blob/master/tools/xfsslower_example.txt This example shows the parsable output format generated by the -j option, useful for data analysis and visualization. ```text ENDTIME_us,TASK,PID,TYPE,BYTES,OFFSET_b,LATENCY_us,FILE 125563830632,randread.pl,12155,R,8192,27824193536,1057,data1 125565050578,randread.pl,12155,R,8192,16908525568,1969,data1 125566331140,randread.pl,12202,R,8192,16310689792,1738,data1 125566427955,randread.pl,12155,R,8192,11127439360,1058,data1 125567223494,randread.pl,12202,R,8192,8422031360,1131,data1 125567331145,randread.pl,12155,R,8192,9233088512,1230,data1 125567331220,randread.pl,12202,R,8192,12716326912,1148,data1 125567334983,randread.pl,12155,R,8192,24545206272,2182,data1 [...] ``` -------------------------------- ### Setup BPF Kernel Source: https://github.com/iovisor/bcc/blob/master/scripts/README.md Run this command inside the VM to set up the kernel with BPF support. It clones the net-next branch and prompts for kernel configuration. ```bash [root@bpf-demo ~]# bpf-kernel-setup Cloning into 'net-next'... ``` -------------------------------- ### Install Binary Clang for Fedora Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Provides commands to download and install specific versions of Clang and LLVM for different Fedora releases, or uses DNF for newer versions. ```bash # FC22 wget http://llvm.org/releases/3.7.1/clang+llvm-3.7.1-x86_64-fedora22.tar.xz sudo tar xf clang+llvm-3.7.1-x86_64-fedora22.tar.xz -C /usr/local --strip 1 # FC23 wget http://llvm.org/releases/3.9.0/clang+llvm-3.9.0-x86_64-fedora23.tar.xz sudo tar xf clang+llvm-3.9.0-x86_64-fedora23.tar.xz -C /usr/local --strip 1 # FC24 and FC25 sudo dnf install -y clang clang-devel llvm llvm-devel llvm-static ncurses-devel ``` -------------------------------- ### Start Tunnel Monitor Simulation Source: https://github.com/iovisor/bcc/blob/master/examples/networking/tunnel_monitor/README.md Launches the main Python script to start the tunnel monitor simulation and an HTTP server for visualization. Press Enter to quit. ```bash [root@bcc-dev tunnel_monitor]# python main.py Launching host 1 of 9 Launching host 2 of 9 ... Starting tunnel 8 of 9 Starting tunnel 9 of 9 HTTPServer listening on 0.0.0.0:8080 Press enter to quit: ``` -------------------------------- ### Build BPF Demo VM Script Source: https://github.com/iovisor/bcc/blob/master/scripts/README.md Use this script to build the initial BPF demo virtual machine. Ensure virt-install is available. ```bash ./build_bpf_demo.sh -n bpf-demo -k bpf_demo.ks.erb ``` -------------------------------- ### Install openSUSE Build Dependencies Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Installs required packages for building BCC on openSUSE, including development tools, compilers, and libraries. LuaJIT support is also included. ```bash sudo zypper in bison cmake flex gcc gcc-c++ git libelf-devel libstdc++-devel \ llvm-devel clang-devel pkg-config python-devel python-setuptools python3-devel \ python3-setuptools sudo zypper in luajit-devel # for lua support in openSUSE Leap 42.2 or later sudo zypper in lua51-luajit-devel # for lua support in openSUSE Tumbleweed ``` -------------------------------- ### Compile and Install Kernel Modules Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Compile and install the necessary kernel modules after checking out the kernel source. This involves configuring the kernel and building modules. ```bash cp Microsoft/config-wsl .config make oldconfig && make prepare make scripts make modules sudo make modules_install ``` -------------------------------- ### Get Cgroup ID using cgroupid Example Source: https://github.com/iovisor/bcc/blob/master/docs/special_filtering.md Compile and run the cgroupid example program to discover the cgroup ID of a given path. This is useful for populating the cgroup map. ```bash # cd examples/cgroupid # make # ./cgroupid hex /sys/fs/cgroup/unified/system.slice/test.service ``` -------------------------------- ### Install BCC on Debian (Binary) Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Installs BCC tools, libraries, and headers from the Debian sid repository. Ensure your system's sources.list is configured correctly. ```bash echo deb http://cloudfront.debian.net/debian sid main >> /etc/apt/sources.list sudo apt-get install -y bpfcc-tools libbpfcc libbpfcc-dev linux-headers-$(uname -r) ``` -------------------------------- ### Clone BCC Repository Source: https://github.com/iovisor/bcc/blob/master/src/lua/README.md Clone the BCC repository to get started with the Lua tooling. ```bash $ git clone https://github.com/iovisor/bcc.git $ cd bcc/ ``` -------------------------------- ### Build USDT Sample with Clang Source: https://github.com/iovisor/bcc/blob/master/examples/usdt_sample/usdt_sample.md Build the usdt_sample using clang. Ensure you are in the bcc root folder and have created a build directory. ```bash $ clang --version Ubuntu clang version 13.0.1-++20211124043029+19b8368225dc-1~exp1~20211124043558.23 ``` ```bash # Make sure you are in the bcc root folder $ mkdir -p examples/usdt_sample/build_clang && cd examples/usdt_sample/build_clang $ cmake .. -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ $ make ``` -------------------------------- ### Install Fedora Build Dependencies (Alternative) Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Installs essential packages for building BCC on Fedora, including optional LuaJIT support and netperf. Uses 'sudo' for elevated privileges. ```bash sudo dnf install -y bison cmake ethtool flex git iperf libstdc++-static \ python-netaddr python-pip gcc gcc-c++ make zlib-devel \ elfutils-libelf-devel python-cachetools sudo dnf install -y luajit luajit-devel # for Lua support sudo dnf install -y \ http://repo.iovisor.org/yum/extra/mageia/cauldron/x86_64/netperf-2.7.0-1.mga6.x86_64.rpm sudo pip install pyroute2 ``` -------------------------------- ### Start USDT Sample Application Source: https://github.com/iovisor/bcc/blob/master/examples/usdt_sample/usdt_sample.md Launches the USDT sample application with specified parameters for input prefix, range, calls per second, and latency. This application is designed to be monitored by BCC scripts. ```bash $ examples/usdt_sample/build/usdt_sample_app1/usdt_sample_app1 "usdt" 1 30 10 1 50 Applying the following parameters: Input prefix: usdt. Input range: [1, 30]. Calls Per Second: 10. Latency range: [1, 50] ms. You can now run the bcc scripts, see usdt_sample.md for examples. pid: 2422725 Press ctrl-c to exit. ``` -------------------------------- ### Trace strings returned by gets() Source: https://github.com/iovisor/bcc/blob/master/tools/argdist_example.txt Use argdist to capture and display string return values from the gets() function. This example attaches a probe to the function's return and filters out null return values. ```bash # ./argdist -i 10 -n 1 -C 'r:c:gets():char*:(char*)$retval:$retval!=0' ``` -------------------------------- ### mysqld_qslower Usage Help Source: https://github.com/iovisor/bcc/blob/master/tools/mysqld_qslower_example.txt Display the usage instructions for the mysqld_qslower script, showing the required arguments for PID and optional minimum latency threshold. ```bash # ./mysqld_qslower.py -h ``` -------------------------------- ### Get Cgroup ID using Docker and cgroupid Example Source: https://github.com/iovisor/bcc/blob/master/docs/special_filtering.md Build and run the cgroupid example within a Docker container to obtain the cgroup ID. Requires privileged mode and volume mounting for cgroup access. ```bash # cd examples/cgroupid # docker build -t cgroupid . # docker run --rm --privileged -v /sys/fs/cgroup:/sys/fs/cgroup \ cgroupid cgroupid hex /sys/fs/cgroup/unified/system.slice/test.service ``` -------------------------------- ### Hello Fields BPF Program Source: https://github.com/iovisor/bcc/blob/master/docs/tutorial_bcc_python_developer.md This program traces the 'clone' system call and prints 'Hello, World!' along with timestamp, command, and PID. It demonstrates attaching a kprobe to a specific syscall using bcc's helper functions. ```Python from bcc import BPF from bcc.utils import printb # define BPF program prog = """ int hello(void *ctx) { bpf_trace_printk("Hello, World!\n"); return 0; } """ # load BPF program b = BPF(text=prog) b.attach_kprobe(event=b.get_syscall_fnname("clone"), fn_name="hello") # header print("%-18s %-16s %-6s %s" % ("TIME(s)", "COMM", "PID", "MESSAGE")) ``` -------------------------------- ### Trace Operation Start BPF Function Source: https://github.com/iovisor/bcc/blob/master/examples/usdt_sample/usdt_sample.md This BPF function traces the start of an operation, capturing input arguments and storing start time and operation ID. It uses a hash map to store the start data. ```c BPF_HASH(start_hash, u64, struct start_data_t); /** * @brief Reads the operation request arguments and stores the start data in the hash. * @param ctx The BPF context. */ __attribute__((section(".bpf.fn.trace_operation_start"))) int trace_operation_start(struct pt_regs* ctx) { struct start_data_t start_data = {}; ({ u64 __addr = 0x0; _bpf_readarg_trace_operation_start_2(ctx, &__addr, sizeof(__addr));bpf_probe_read_user(&start_data.input, sizeof(start_data.input), (void *)__addr);}); if (!filter(start_data.input)) { return 0; } ///< Replaced by python code. _bpf_readarg_trace_operation_start_1(ctx, &start_data.operation_id, sizeof(*(&start_data.operation_id))); start_data.start = bpf_ktime_get_ns(); bpf_map_update_elem((void *)bpf_pseudo_fd(1, -1), &start_data.operation_id, &start_data, BPF_ANY); return 0; } ``` -------------------------------- ### Install Debian Build Dependencies Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Install the required build dependencies for BCC on Debian 'sid'. Ensure you run 'apt-get update' before installing packages. ```bash # Before you begin apt-get update # According to https://packages.debian.org/source/sid/bpfcc, # BCC build dependencies: sudo apt-get install arping bison clang-format cmake dh-python \ dpkg-dev pkg-kde-tools ethtool flex inetutils-ping iperf \ libbpf-dev libclang-dev libclang-cpp-dev libedit-dev libelf-dev \ libfl-dev libzip-dev linux-libc-dev llvm-dev libluajit-5.1-dev \ luajit python3-netaddr python3-pyroute2 python3-setuptools python3 \ zip libpolly-19-dev ``` -------------------------------- ### Run Neighbor Sharing Example Source: https://github.com/iovisor/bcc/blob/master/examples/networking/neighbor_sharing/README.txt Execute the Python script to set up the network simulation. This script configures BPF programs and tc filters for rate limiting. ```bash sudo /path/to/neighbor_sharing/neighbor_sharing.py ``` -------------------------------- ### Example: Time do_sys_open() Interval Source: https://github.com/iovisor/bcc/blob/master/tools/funcinterval_example.txt Demonstrates timing the interval of the 'do_sys_open' function. ```bash # time the interval of do_sys_open() ./funcinterval do_sys_open ``` -------------------------------- ### Install Ubuntu Build Dependencies (Focal) Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Install build dependencies for BCC on Ubuntu Focal (20.04.1 LTS). This command installs essential tools and libraries required for compilation. ```bash # For Focal (20.04.1 LTS) sudo apt install -y zip bison build-essential cmake flex git libedit-dev \ libllvm12 llvm-12-dev libclang-12-dev python zlib1g-dev libelf-dev libfl-dev python3-setuptools \ liblzma-dev arping netperf iperf ``` -------------------------------- ### Install Ubuntu Build Dependencies (Noble Numbat) Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Install build dependencies for BCC on Ubuntu Noble Numbat (24.04). This command installs LLVM 18 and associated development packages. ```bash # For Noble Numbat (24.04) sudo apt install -y zip bison build-essential cmake flex git libedit-dev \ libllvm18 llvm-18-dev libclang-18-dev python3 zlib1g-dev libelf-dev libfl-dev python3-setuptools \ liblzma-dev libdebuginfod-dev arping netperf iperf libpolly-18-dev ``` -------------------------------- ### Install BCC on RHEL 7.6 Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Install BCC tools from the official RHEL 7.6 yum repository. This command also installs necessary dependencies like bcc, llvm-private, and python-bcc. ```bash yum install bcc-tools ``` -------------------------------- ### Build USDT Sample Application Source: https://github.com/iovisor/bcc/blob/master/examples/usdt_sample/usdt_sample.md Compiles the USDT sample application using GCC and CMake. This involves creating a build directory, configuring with CMake, and then building the application. ```bash $ gcc --version gcc (Ubuntu 11.2.0-7ubuntu2) 11.2.0 ... # Make sure you are in the bcc root folder $ mkdir -p examples/usdt_sample/build && cd examples/usdt_sample/build $ cmake .. $ make ``` -------------------------------- ### Run filetop with default options Source: https://github.com/iovisor/bcc/blob/master/tools/filetop_example.txt Execute filetop to trace file I/O operations. Output is sorted by total read size in Kbytes by default. Press Ctrl-C to end. ```bash # ./filetop -C Tracing... Output every 1 secs. Hit Ctrl-C to end 08:00:23 loadavg: 0.91 0.33 0.23 3/286 26635 PID COMM READS WRITES R_Kb W_Kb T FILE 26628 ld 161 186 643 152 R built-in.o 26634 cc1 1 0 200 0 R autoconf.h 26618 cc1 1 0 200 0 R autoconf.h 26634 cc1 12 0 192 0 R tracepoint.h 26584 cc1 2 0 143 0 R mm.h 26634 cc1 2 0 143 0 R mm.h 26631 make 34 0 136 0 R auto.conf 26634 cc1 1 0 98 0 R fs.h 26584 cc1 1 0 98 0 R fs.h 26634 cc1 1 0 91 0 R sched.h 26634 cc1 1 0 78 0 R printk.c 26634 cc1 3 0 73 0 R mmzone.h 26628 ld 18 0 72 0 R hibernate.o 26628 ld 16 0 64 0 R suspend.o 26628 ld 16 0 64 0 R snapshot.o 26628 ld 16 0 64 0 R qos.o 26628 ld 13 0 52 0 R main.o 26628 ld 12 0 52 0 R swap.o [...] ``` -------------------------------- ### Run Queue Latency Analysis on Idle System Source: https://github.com/iovisor/bcc/blob/master/tools/runqlat_example.txt This example demonstrates runqlat on a CPU-idle system, showing minimal run queue latency. The output is scaled to microseconds, highlighting the difference from a CPU-bound workload. ```bash # ./runqlat 5 1 Tracing run queue latency... Hit Ctrl-C to end. usecs : count distribution 0 -> 1 : 2250 |******************************** | 2 -> 3 : 2340 |********************************** | 4 -> 7 : 2746 |****************************************| 8 -> 15 : 418 |****** | 16 -> 31 : 93 |* | 32 -> 63 : 28 | | 64 -> 127 : 119 |* | 128 -> 255 : 9 | | 256 -> 511 : 4 | | 512 -> 1023 : 20 | | 1024 -> 2047 : 22 | | 2048 -> 4095 : 5 | | 4096 -> 8191 : 2 | | ``` -------------------------------- ### Install BCC on Arch Linux Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Install BCC and related Python bindings using the pacman package manager on Arch Linux. This command installs the core BCC tools, tools, and Python bindings. ```bash pacman -S bcc bcc-tools python-bcc ``` -------------------------------- ### Install BCC on Amazon Linux 1 (Default Kernel) Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Install BCC for the default kernel on Amazon Linux 1 without requiring a reboot. This involves installing specific kernel headers and devel packages. ```bash sudo yum install kernel-headers-$(uname -r | cut -d'.' -f1-5) sudo yum install kernel-devel-$(uname -r | cut -d'.' -f1-5) sudo yum install bcc ``` -------------------------------- ### Sample Allocations with Memleak Source: https://github.com/iovisor/bcc/blob/master/tools/memleak_example.txt Control overhead by sampling every N-th allocation. This example samples roughly 10% of allocations and prints output 3 times with a 5-second interval. ```bash # ./memleak 5 3 ``` -------------------------------- ### Build BCC from Source Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Clones the BCC repository, configures the build using CMake, compiles the project, and installs it. Uses 'pushd' and 'popd' for directory management. ```bash git clone https://github.com/iovisor/bcc.git pushd . mkdir bcc/build; cd bcc/build cmake3 .. time make sudo make install popd ``` -------------------------------- ### Tracepoint format example Source: https://github.com/iovisor/bcc/blob/master/docs/tutorial_bcc_python_developer.md This example shows the format of arguments for the sys_enter_setuid tracepoint, which can be found in /sys/kernel/debug/tracing/events/syscalls/sys_enter_setuid/format. ```Shell # sudo cat /sys/kernel/debug/tracing/events/syscalls/sys_enter_setuid/format name: sys_enter_setuid ID: 256 format: field:unsigned short common_type; offset:0; size:2; signed:0; field:unsigned char common_flags; offset:2; size:1; signed:0; field:unsigned char common_preempt_count; offset:3; size:1; signed:0; field:int common_pid; offset:4; size:4; signed:1; field:int __syscall_nr; offset:8; size:4; signed:1; field:uid_t uid; offset:16; size:8; signed:0; print fmt: "uid: 0x%08lx", ((unsigned long)(REC->uid)) ``` -------------------------------- ### Virtiostat Usage Help Source: https://github.com/iovisor/bcc/blob/master/tools/virtiostat_example.txt Display the help message for virtiostat, showing available options and arguments. ```bash #./virtiostat -h usage: virtiostat.py [-h] [-T] [-d DRIVER] [-n DEVNAME] [-D] [interval] [count] Show virtio devices input/output statistics positional arguments: interval output interval, in seconds count number of outputs optional arguments: -h, --help show this help message and exit -T, --timestamp show timestamp on output -d DRIVER, --driver DRIVER filter for driver name -n DEVNAME, --devname DEVNAME filter for device name -D, --debug print BPF program before starting (for debugging purposes) examples: ./virtiostat # print 3(default) second summaries ./virtiostat 1 10 # print 1 second summaries, 10 times ./virtiostat -T # show timestamps ./virtiostat -d virtio_blk # only show virtio block devices ./virtiostat -n virtio0 # only show virtio0 device ./virtiostat -D # show debug bpf text ``` -------------------------------- ### Install BCC on Amazon Linux 1 (Latest Kernel) Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Update the kernel and install BCC on Amazon Linux 1. This use case ensures BCC is installed for the latest available kernel in the repository. A reboot is required. ```bash sudo yum update kernel sudo yum install bcc sudo reboot ``` -------------------------------- ### Test BCC Tool Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Runs the 'execsnoop' tool from the installed BCC tools to verify the installation and functionality. ```bash sudo /usr/share/bcc/tools/execsnoop ``` -------------------------------- ### stacksnoop command examples Source: https://github.com/iovisor/bcc/blob/master/examples/tracing/stacksnoop_example.txt Provides examples of how to use stacksnoop with different options. These include tracing a function, showing symbol offsets, enabling verbose output, and filtering by a specific PID. ```bash ./stacksnoop ext4_sync_fs # print kernel stack traces for ext4_sync_fs ./stacksnoop -s ext4_sync_fs # ... also show symbol offsets ./stacksnoop -v ext4_sync_fs # ... show extra columns ./stacksnoop -p 185 ext4_sync_fs # ... only when PID 185 is on-CPU ``` -------------------------------- ### Build and Test BCC Source: https://github.com/iovisor/bcc/blob/master/scripts/README.md Run this command to build and test the BCC framework after setting up the kernel and LLVM. It clones the bcc repository and runs tests. ```bash [root@bpf-demo ~]# bcc-setup Cloning into 'bcc'... ... Linking CXX shared library libcc.so [100%] Built target bcc ... Running tests... Test project /root/bcc/build Start 1: py_test1 1/4 Test #1: py_test1 ......................... Passed 0.24 sec Start 2: py_test2 2/4 Test #2: py_test2 ......................... Passed 0.53 sec Start 3: py_trace1 3/4 Test #3: py_trace1 ........................ Passed 0.09 sec Start 4: py_trace2 4/4 Test #4: py_trace2 ........................ Passed 1.06 sec 100% tests passed, 0 tests failed out of 4 ``` -------------------------------- ### Install libbpf-tools Dependencies Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Install LLVM and Clang. These are additional dependencies specifically for the libbpf-tools component of BCC. ```bash # Additional dependencies for libbpf-tools sudo apt-get -y install llvm clang ``` -------------------------------- ### Install BCC Lua Rock Source: https://github.com/iovisor/bcc/blob/master/src/lua/README.md Install the BCC Lua rock using LuaRocks package manager. ```bash $ luarocks install bpf ``` -------------------------------- ### List BPF Programs with bps.c Source: https://github.com/iovisor/bcc/blob/master/README.md Use 'bps.c' to list all BPF programs loaded into the kernel, functioning like 'ps' for BPF programs. No specific setup is required beyond having the tool available. ```c #include int kprobe__sys_clone(struct pt_regs *ctx) { return 0; } ``` -------------------------------- ### Install BCC Dependencies Source: https://github.com/iovisor/bcc/blob/master/src/lua/README.md Install necessary BCC tools, libraries, and kernel headers on Ubuntu 18.04 LTS. ```bash $ sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 4052245BD4284CDD $ echo "deb https://repo.iovisor.org/apt/$(lsb_release -cs) $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/iovisor.list $ sudo apt-get update $ sudo apt-get install bcc-tools libbcc-examples linux-headers-$(uname -r) ``` -------------------------------- ### Compile and Install BCC on Ubuntu Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Clone the BCC repository, configure with CMake, and compile/install BCC. This includes building Python 3 bindings. ```bash git clone https://github.com/iovisor/bcc.git mkdir bcc/build; cd bcc/build cmake .. make sudo make install cmake -DPYTHON_CMD=python3 .. # build python3 binding pushd src/python/ make sudo make install popd ``` -------------------------------- ### Bindsnoop example: trace specific port Source: https://github.com/iovisor/bcc/blob/master/tools/bindsnoop_example.txt Example command to trace bind() calls only for a specific port number. ```bash ./bindsnoop -P 80 ``` -------------------------------- ### Example: Output Every 5 Seconds with Timestamps Source: https://github.com/iovisor/bcc/blob/master/tools/funcinterval_example.txt Traces 'vfs_read' with millisecond histograms, outputs every 5 seconds, and includes timestamps. ```bash # output every 5 seconds, with timestamps ./funcinterval -mTi 5 vfs_read ``` -------------------------------- ### Run tcplife with Timestamps and Wide Output Source: https://github.com/iovisor/bcc/blob/master/tools/tcplife_example.txt Combine -t and -w options for detailed TCP session summaries with timestamps and wider columns to fit all information. ```bash # ./tcplife -t -w ``` -------------------------------- ### Install Lua Support Dependencies Source: https://github.com/iovisor/bcc/blob/master/INSTALL.md Install LuaJIT and its development headers. These are required if you intend to use BCC with Lua scripting. ```bash # For Lua support sudo apt-get -y install luajit luajit-5.1-dev ```