BCC源码内容概览（1）

接前一篇文章：BCC源码编译和安装

本文参考官网中的Contents部分的介绍。

BCC源码根目录的文件，其中一些是同时包含C和Python的单个文件，另一些是.c和.py的成对文件，还有一些是目录。

跟踪（Tracing）

examples目录下的文件：

• examples/tracing/bitehist.py

块I/O大小直方图。

bcc/examples/tracing/bitehist.txt文件内容如下：

Demonstrations of bitehist.py, the Linux eBPF/bcc version.

This prints a power-of-2 histogram to show the block I/O size distribution.
A summary is printed after Ctrl-C is hit.

# ./bitehist.py
Tracing... Hit Ctrl-C to end.
^C
     kbytes          : count     distribution
       0 -> 1        : 3        |                                      |
       2 -> 3        : 0        |                                      |
       4 -> 7        : 211      |**********                            |
       8 -> 15       : 0        |                                      |
      16 -> 31       : 0        |                                      |
      32 -> 63       : 0        |                                      |
      64 -> 127      : 1        |                                      |
     128 -> 255      : 800      |**************************************|

This output shows a bimodal distribution. The largest mod of 800 I/O were
between 128 and 255 Kbytes in size, and another mode of 211 I/O were between
4 and 7 Kbytes in size.

Understanding this distribution is useful for characterizing workloads and
understanding performance. The existence of this distribution is not visible
from averages alone.

• examples/tracing/disksnoop.py

跟踪块设备I/O延迟。

bcc/examples/tracing/disksnoop_example.txt文件内容如下：

Demonstrations of disksnoop.py, the Linux eBPF/bcc version.


This traces block I/O, a prints a line to summarize each I/O completed:

# ./disksnoop.py 
TIME(s)            T  BYTES    LAT(ms)
16458043.435457    W  4096        2.73
16458043.435981    W  4096        3.24
16458043.436012    W  4096        3.13
16458043.437326    W  4096        4.44
16458044.126545    R  4096       42.82
16458044.129872    R  4096        3.24
16458044.130705    R  4096        0.73
16458044.142813    R  4096       12.01
16458044.147302    R  4096        4.33
16458044.148117    R  4096        0.71
16458044.148950    R  4096        0.70
16458044.164332    R  4096       15.29
16458044.168003    R  4096        3.58
16458044.171676    R  4096        3.59
16458044.172453    R  4096        0.72
16458044.173213    R  4096        0.71
16458044.173989    R  4096        0.72
16458044.174739    R  4096        0.70
16458044.190334    R  4096       15.52
16458044.196608    R  4096        6.17
16458044.203091    R  4096        6.35

The output includes a basic timestamp (in seconds), the type of I/O (W == write,
R == read, M == metadata), the size of the I/O in bytes, and the latency (or
duration) of the I/O in milliseconds.

The latency is measured from I/O request to the device, to the device
completion. This excludes latency spent queued in the OS.

Most of the I/O in this example were 0.7 and 4 milliseconds in duration. There
was an outlier of 42.82 milliseconds, a read which followed many writes (the
high latency may have been caused by the writes still being serviced on the
storage device).

• examples/hello_world.py

为新进程打印“Hello, World!”。

bcc/examples/hello_world.py文件内容如下：

#!/usr/bin/python
# Copyright (c) PLUMgrid, Inc.
# Licensed under the Apache License, Version 2.0 (the "License")

# run in project examples directory with:
# sudo ./hello_world.py"
# see trace_fields.py for a longer example

from bcc import BPF

# This may not work for 4.17 on x64, you need replace kprobe__sys_clone with kprobe____x64_sys_clone
BPF(text='int kprobe__sys_clone(void *ctx) { bpf_trace_printk("Hello, World!\\n"); return 0; }').trace_print()

• examples/tracing/mysqld_query.py

使用USDT探测跟踪MySQL服务器查询。

bcc/examples/tracing/mysqld_query.txt文件内容如下：

# ./mysqld_query.py `pgrep -n mysqld`
TIME(s)            COMM             PID    QUERY
17450459.549910001 mysqld           18608  select @@version_comment limit 1
17450463.822668001 mysqld           18608  SELECT DATABASE()
17450463.824042998 mysqld           18608  show databases
17450463.824570000 mysqld           18608  show tables
17450465.602717999 mysqld           18608  SELECT COUNT(*) FROM words
17450479.944897000 mysqld           18608  SELECT * FROM words WHERE word REGEXP '^bre.*n$'