biosnoop.bt(8)

💅 biosnoop.bt — bestie's guide to watching your disk do cardio

okay so. this is biosnoop.bt, and she lives in section 8 of the System Manager's Manual (that's the USER COMMANDS corner of the manual, for my fellow manual-section girlies 🫶). she's a block I/O tracing tool that shows you per-I/O latency, and she runs on bpftrace / eBPF. yes. the cool kind. ✨

---

🎀 NAME

biosnoop.bt — a Block I/O tracing tool, showing per I/O latency. Uses bpftrace/eBPF.

🌸 SYNOPSIS

biosnoop.bt

that's it. that's the whole synopsis. no flags, no args, she just goes. 👑

💖 DESCRIPTION

so basically: this is a basic block I/O (aka disk I/O) tracing tool. it shows you every single I/O event, along with the process ID that issued it and the I/O latency. if your disk is acting up and you're like "why is everything slow 😭", this is the tool you reach for to investigate disk I/O performance issues. it's giving detective. it's giving forensics. 🔍

okay now the slightly unhinged part, and i need you to hear me: this tool currently works by dynamic tracing of the blk_account*() kernel functions. that means if the kernel girlies change those functions in a future kernel version, this tool will need updating to match. it's lowkey living on the edge. 🙈

and because this uses BPF, only the root user can use this tool. no root, no snoop. periodt.

✨ REQUIREMENTS ✨

• CONFIG_BPF
• bpftrace

both. you need both. no skipping. 🧚

🦋 EXAMPLES

trace block I/O events and print per-line summaries:

# biosnoop.bt

that's the whole vibe. she prints a line per event and you read it. 💅

🌈 FIELDS

here's what each column is actually telling you, bestie:

• TIME — the time of the I/O completion, in milliseconds since the program started. so like, ms-since-we-started-watching. ⏱️
• DISK ID — the major and minor device numbers of the disk device. that's how you know which disk.
• COMM — the issuing process name. this often identifies the issuing application process, but ngl, I/O may be initiated from kernel threads only. so don't @ the app every single time. 😭
• PID — the issuing process ID. same caveat, same energy: this often identifies the issuing application process, but I/O may be initiated from kernel threads only.
• LAT(ms) — the per I/O latency. the number you actually came here for. 🔥

🍓 OVERHEAD

okay so, good news: since block device I/O usually has a relatively low frequency (< 10,000/s), the overhead for this tool is expected to be negligible. slay.

but for high IOPS storage systems? test and quantify before use. do not just rawdog it onto a busy box. 🫶

💜 SOURCE

this is from bpftrace.

https://github.com/bpftrace/bpftrace

also, look in the bpftrace distribution for a companion _examples.txt file — it's got example usage, output, and commentary for this tool. it's the director's cut. 🎬

this is a bpftrace version of the bcc tool of the same name. and heads up: the bcc tool provides more fields. so if you want extra columns, you know where to go. 👀

https://github.com/iovisor/bcc

🌸 OS

Linux. (as always. 💀)

⭐ STABILITY

Unstable — in development. she's a work in progress and we love her anyway. 🎀

👑 AUTHOR

Brendan Gregg

🫶 SEE ALSO

• opensnoop.bt(8)

---

and that's the whole page, bestie!! this one came from the System Manager's Manual, dated 2018-09-11, and it's filed under USER COMMANDS — so next time you're in the manual, tell her hi for me. 💖✨