funccount(8)

✨ NAME ✨

okay so funccount is the tool that counts function, tracepoint, and USDT probe calls matching a pattern 🔍💖 it's Linux eBPF/bcc, so it's giving low-level and I'm obsessed.

🎀 SYNOPSIS 🎀

funccount [-h] [-p PID] [-i INTERVAL] [-d DURATION] [-T] [-r] [-c CPU]
[-D] pattern

💅 DESCRIPTION 💅

bestie, this is the quick way to figure out which functions are getting called and how often 🦋 It uses in-kernel eBPF maps to do the counting, so it's lowkey so efficient.

⚠️ WARNING: This uses dynamic tracing of (what can be many) functions, and that has caused issues on some kernel versions (risk of panics or freezes) 💀 Test it, and know what you're doing, before you use it!!

Since this uses BPF, only the root user can use this tool 👑

🧚 REQUIREMENTS 🧚

You need CONFIG_BPF and bcc. No cap, no skipping this 🫶

🌸 OPTIONS 🌸

• pattern — your search pattern 🔍 It supports * wildcards (see EXAMPLES), and if you want regular expressions instead, pair it with -r.
• -h — prints the usage message 💜
• -p PID — only traces this process ID 🎯
• -i INTERVAL — prints output every INTERVAL seconds ⏰
• -d DURATION — total duration of the trace in seconds ⌛
• -T — adds timestamps to the output 🕰️
• -r — uses regular expressions for the search pattern 🧠
• -D — prints the BPF program before it starts (for debugging, iykyk) 🙈
• -c CPU — only traces on this CPU 🍓

🌈 EXAMPLES 🌈

okay here's where it gets fun ✨

Count kernel functions beginning with "vfs_", until Ctrl-C is hit:

# funccount 'vfs_*'

Count kernel functions beginning with "tcp_send", until Ctrl-C is hit:

# funccount 'tcp_send*'

Print kernel functions beginning with "vfs_", every second:

# funccount -i 1 'vfs_*'

Print kernel functions beginning with "vfs_", for ten seconds only:

# funccount -d 10 'vfs_*'

Match kernel functions beginning with "vfs_", using regular expressions:

# funccount -r '^vfs_.*'

Count vfs calls for process ID 181 only:

# funccount -p 181 'vfs_*'

Count calls to the sched_fork tracepoint, indicating a fork() performed:

# funccount t:sched:sched_fork

Count all GC USDT probes in the Node process:

# funccount -p 185 u:node:gc*

Count all malloc() calls in libc:

# funccount c:malloc

Count kernel functions beginning with "vfs_" on CPU 1 only:

# funccount -c 1 'vfs_*'

🎀 FIELDS 🎀

• FUNC — the function name 🦋
• COUNT — how many calls happened while tracing 🔥

🫧 OVERHEAD 🫧

So this traces functions and keeps in-kernel counts, which then get asynchronously copied to user-space 🛸 Even if the call rate is super high (>1M/sec), this is a relatively efficient way to trace these events, so the overhead should be small for normal workloads. Still, measure in a test environment before you use it, periodt 💅

🔭 SOURCE 🔭

This is from bcc 💖

https://github.com/iovisor/bcc

Also check the bcc distribution for a companion _examples.txt file with example usage, output, and commentary for this tool 📚

💻 OS 💻

Linux 🐧

🧪 STABILITY 🧪

Unstable, it's still in development 🚧

👩‍💻 AUTHOR 👩‍💻

Brendan Gregg and Sasha Goldshtein 👑

🌟 SEE ALSO 🌟

stackcount(8), funclatency(8), vfscount(8) ✨

---

Byeee bestie, go count some calls 🥰 USER COMMANDS · 2015-08-18 · funccount(8) 💜✨