biosnoop.bt(8)

📦 version 0.17.0, in debian bookworm

👑 biosnoop.bt — the block I/O bestie

okay so listen, bestie: this is biosnoop.bt, and it lives in section 8 of the System Manager's Manual, aka the System Manager's Manual zone. It's a block I/O tracing tool that shows you per-I/O latency, and it runs on bpftrace/eBPF. It's giving observability. It's giving I can see your disk struggling. 💅

✨ SYNOPSIS ✨

biosnoop.bt

no flags, no arguments, no drama. just vibes and root privileges (we'll get there).

🌸 DESCRIPTION 🌸

So this is a basic block I/O (disk I/O) tracing tool. It shows you every single I/O event as it happens, along with the process ID that issued it, plus the I/O latency. Lowkey the perfect thing to reach for when you're like "why is my disk acting up" — it's made for investigating disk I/O performance issues. 🩺

The way it works right now: it dynamically traces the blk_account*() kernel functions. Which means — heads up — that tracing will need updating to match any changes to those functions in future kernel versions. It's not set-and-forget forever, bestie, it's tied to kernel internals. 🫠

And because this uses BPF: only the root user can use this tool. No root, no snoop. Sorry not sorry, that's just the rules. 🔒

🎀 REQUIREMENTS 🎀

  • CONFIG_BPF
  • bpftrace

that's the whole list. short, sweet, iconic.

🦋 EXAMPLES 🦋

Trace block I/O events, printing per-line summaries:

# biosnoop.bt

that's it, that's the whole invocation. she's simple like that. ✨

💖 FIELDS 💖

  • TIME — when the I/O completed, in milliseconds since the program started. ⏱️
  • COMM — the name of the process that issued it. This often identifies the issuing application process, but ngl, I/O can be initiated from kernel threads only, so sometimes it's just a kernel thread and not your app at all. 😭
  • PID — the ID of the issuing process. Same disclaimer as COMM: it often points at the issuing application process, but I/O may be initiated from kernel threads only. 🫶
  • ARGS — process name and arguments (16 word maximum). 📝

🔥 OVERHEAD 🔥

Good news: block device I/O is usually pretty low frequency (< 10,000/s), so the overhead here is expected to be negligible. She's light on her feet. 💃

But for high IOPS storage systems: test and quantify before use. Do not just yolo it onto a busy box. 🙈

🌈 SOURCE 🌈

This one is from bpftrace:

https://github.com/iovisor/bpftrace

Also — peek in the bpftrace distribution for a companion _examples.txt file, it's got example usage, output, and commentary for this tool. Free lore. 📖

And fun fact: this is a bpftrace version of the bcc tool of the same name. The bcc tool provides more fields, so if you want the deluxe version, that's where to look:

https://github.com/iovisor/bcc

⭐ OS ⭐

Linux. obviously. 💀

💜 STABILITY 💜

Unstable — in development. She's a work in progress, a growing girl, we love her anyway. 🧚

🍓 AUTHOR 🍓

Brendan Gregg

👑 SEE ALSO 👑

okay that's the whole page bestie, you're fully caught up 💖

this page is filed under USER COMMANDS, from way back on 2018-09-11 — yeah she's vintage, but she still slays ✨

📦 where this page comes from