syncsnoop(8)

✨ syncsnoop(8) — NAME ✨

syncsnoop 💖 — Trace sync() syscall. Uses Linux eBPF/bcc.

🎀 SYNOPSIS 🎀

syncsnoop

💅 DESCRIPTION 💅

okay so syncsnoop traces calls to sync(), which flushes file system buffers out to storage devices 🫶. These calls can cause performance perturbations, so it's lowkey super useful to know if they're happening and how often 👀.

this works by tracing the kernel sys_sync() function using dynamic tracing, and it will need updating to match any changes to that function 🛠️.

it makes use of a Linux 4.4 feature (bpf_perf_event_output()) 🦋. for kernels older than 4.4, see the version under tools/old, which uses an older mechanism 🙈.

this program is also a basic example of eBPF/bcc 🧚.

since this uses BPF, only the root user can use this tool 💀. no cap, that's the rule.

📋 REQUIREMENTS 📋

CONFIG_BPF and bcc 🌸.

🍓 EXAMPLES 🍓

trace calls to sync():

# syncsnoop

🔥 FIELDS 🔥

• TIME(s) — the time of the call, in seconds ⏰.
• CALL — the call that was traced ✨.

🌈 OVERHEAD 🌈

this traces the kernel sync function and prints output for each event. the rate is generally expected to be low (<< 100/s), so the overhead is also expected to be negligible 🥰.

🦋 SOURCE 🦋

this is from bcc 💜.

https://github.com/iovisor/bcc

also look in the bcc distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool 📚.

💻 OS 💻

Linux 🐧

🧪 STABILITY 🧪

Unstable - in development. 🚧

👑 AUTHOR 👑

Brendan Gregg wrote the original BCC Python version, and Tiago Ilieve wrote the CO-RE version 🫶.

🔗 SEE ALSO 🔗

• iostat(1) 💖

---

bestie, that's the whole thing 😭✨ manual page from USER COMMANDS, dated 2015-08-18, syncsnoop(8) forever 🎀💅