statsnoop(8)

✨ NAME ✨

statsnoop 🦋 is the manual page for statsnoop(8), and it traces stat() syscalls using Linux eBPF/bcc. Basically it's a spy for file lookups 🕵️‍♀️

🧚 SYNOPSIS 🧚

statsnoop [-h] [-t] [-x] [-p PID]

💜 DESCRIPTION 💜

okay so statsnoop traces the different stat() syscalls and shows you which processes are trying to read info about which files 👀 this is lowkey perfect for finding where config and log files live, or for figuring out why an app is failing, especially on startup 🫶

It works by tracing various kernel sys_stat() functions with dynamic tracing 🔍 bestie, that means it will need updating if those functions ever change 😭

This makes use of a Linux 4.4 feature (bpf_perf_event_output()). For kernels older than 4.4, check out the version under tools/old, which uses an older mechanism 🕰️

Since this runs on BPF, only the root user can use this tool 👑 no cap, no exceptions.

🎀 REQUIREMENTS 🎀

You need CONFIG_BPF and bcc ✨

💅 OPTIONS 💅

• -h — the usage message, for when you forget what you're doing 🙈
• -t — adds a timestamp column, in seconds since the first event, with decimal places ⏱️
• -x — only shows the stats that failed 💀
• -p PID — traces only this process ID, filtered in-kernel 🎯

🍓 EXAMPLES 🍓

Trace all stat() syscalls:

# statsnoop

Trace all stat() syscalls, and include timestamps:

# statsnoop -t

Trace only stat() syscalls that failed:

# statsnoop -x

Trace PID 181 only:

# statsnoop -p 181

🌈 FIELDS 🌈

• TIME(s) — when the call happened, in seconds ⏰
• PID — the process ID 🪪
• COMM — the process name 🏷️
• FD — the file descriptor if it worked, or -1 if it failed 📁
• ERR — the error number (check the system's errno.h for the tea ☕)
• PATH — the open path 🛣️

🔥 OVERHEAD 🔥

This traces the kernel stat function and prints output for each event 👁️ the rate is generally expected to be low (< 1000/s), so the overhead should be negligible 🫧 but if your app is calling a high rate of stat()s, then test and understand the overhead before you use it, periodt 😤

🦋 SOURCE 🦋

This is from bcc 💖

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion _examples.txt file with example usage, output, and commentary for this tool 📚

🖥️ OS 🖥️

Linux 🐧

🧪 STABILITY 🧪

Unstable - in development. 🚧

⭐ AUTHOR ⭐

Brendan Gregg 👩‍💻✨

🌸 SEE ALSO 🌸

opensnoop(1) 💫

---

Anyway, that's the whole tea on statsnoop(8) 🫶 It's from the USER COMMANDS section and dated 2016-02-08 💕 Stay curious, bestie, and go trace some stats 💅✨