biosnoop(8)

🎀 biosnoop(8) · System Manager's Manual 🎀

Okay bestie, let's talk about biosnoop, the tool that spills the tea on every block device I/O (aka disk I/O) 💅

✨ NAME ✨

biosnoop is the manual name: "Trace block device I/O and print details incl. issuing PID." 🦋

💖 SYNOPSIS 💖

biosnoop [-h] [-Q] [-d DISK] [-P]

🌸 DESCRIPTION 🌸

okay so this tool traces block device I/O (disk I/O) and prints a one-line summary for each I/O, showing all the juicy details 👀 That includes the latency from the time of issue to the device until it completes, plus the PID and process name from when the I/O was first created. That usually tells you which process is responsible, so it's giving detective energy 🕵️‍♀️

This is lowkey clever: it uses in-kernel eBPF maps to cache process details (PID and comm) by I/O request, and it also stores a starting timestamp so it can calculate the I/O latency ✨

It works by tracing various kernel blk_*() functions using dynamic tracing. Heads up, it will need updating to match any changes to those functions 🙈

This makes use of a Linux 4.4 feature, bpf_perf_event_output(). For kernels older than 4.4, check out the version under tools/old, which uses an older mechanism 🧚

🚨 Since this uses BPF, only the root user can use this tool. No cap, that's a hard rule 🔥

🎀 REQUIREMENTS 🎀

You need CONFIG_BPF and bcc. Non-negotiable, bestie 💜

👑 OPTIONS 👑

• -h — Prints the usage message 💅
• -Q — Adds a column showing the time spent queued in the OS 🫶
• -d DISK — Only traces this disk 🎯
• -P — Displays the block I/O pattern, sequential or random 🦋

🍓 EXAMPLES 🍓

Trace all block device I/O and print a summary line per I/O:

# biosnoop

🌈 FIELDS 🌈

The output columns are giving main character energy, so here's what each one means:

• TIME(s) — When the I/O completed, in seconds since the first I/O was seen ⏰
• COMM — Cached process name, if there is one. This usually identifies the responsible process, but it isn't guaranteed 🙈
• PID — Cached process ID, if there is one. Same deal: usually the responsible process, not guaranteed 🧚
• DISK — Disk device name 💾
• T — Type of I/O: R = read, W = write. This is a simplification, so don't take it as gospel 💀
• SECTOR — Device sector for the I/O 🧩
• BYTES — Size of the I/O, in bytes 📦
• QUE(ms) — Time the I/O sat queued in the OS before it was issued to the device, in milliseconds ⏳
• LAT(ms) — Latency from the issue to the device until completion, in milliseconds ⚡

🥺 OVERHEAD 🥺

Block device I/O usually has a relatively low frequency (under 10,000/s), so the overhead for this tool is expected to be negligible ✨ For high IOPS storage systems, test and quantify before use, periodt 😭

🔗 SOURCE 🔗

This is from bcc 🌸

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion _examples.txt file with example usage, output, and commentary for this tool 📚

🌊 OS 🌊

Linux 🐧

🧪 STABILITY 🧪

Unstable, still in development 🚧

💅 AUTHOR 💅

Brendan Gregg and Rocky Xing, the queens behind this one 👑

🦋 SEE ALSO 🦋

disksnoop(8), iostat(1) ✨

---

Bye bestie 💖 This page is from USER COMMANDS, dated 2015-09-16, and it's all about biosnoop(8) 🫶🎀