dcsnoop.bt(8)

📦 version 0.17.0, in debian bookworm

💅 dcsnoop.bt — bestie edition ✨

okay so this is dcsnoop.bt(8), a System Manager's Manual page, and it's literally about tracing directory entry cache (dcache) lookups with bpftrace/eBPF. let's get into it 🫶

🌸 NAME 🌸

dcsnoop.bt — trace directory entry cache (dcache) lookups. uses bpftrace/eBPF. that's the whole vibe. 👑

✨ SYNOPSIS ✨

dcsnoop.bt

that's it. no flags in the synopsis. she's simple, she's iconic, she just runs. 💅

💖 DESCRIPTION 💖

so by default, this traces every single dcache lookup, and shows you the process doing the lookup plus the filename it asked for. no cap. 🔍

the output of this tool can get verbose, and it's intended for further investigations of dcache performance beyond dcstat(8), which prints per-second summaries. so like, dcstat(8) is the vibe check, and dcsnoop.bt is the full deep dive. 🌊

this uses kernel dynamic tracing of the d_lookup() function, and it will need and will need updating to match any changes to this function. 🫠 (yes bestie, that's the actual wording — the function can change and this tool has to keep up.)

since this uses BPF, only the root user can use this tool. sorry bestie, no root, no snoop. 🔒

🎀 REQUIREMENTS 🎀

  • CONFIG_BPF
  • and bcc.

that's the checklist. don't skip it. ✅

🌈 EXAMPLES 🌈

trace all dcache lookups:

# dcsnoop.bt

that's the one example and honestly it ate. 💯

🦋 FIELDS 🦋

  • TIME(ms) — time of lookup, in milliseconds. ⏱️
  • PID — process ID.
  • COMM — process name.
  • T — type: R == reference, M == miss. a miss will print two lines, one for the reference and one for the miss. so one miss = double the lines, that's just how she works. 😭
  • FILE — the file name component that was being looked up. this contains trailing pathname components (after /), which will be the subject of subsequent lookups. iykyk. 🧚

🔥 OVERHEAD 🔥

file name lookups can be frequent (depending on the workload), and this tool prints a line for each failed lookup, and with -a, each reference as well. so yeah, it can get chatty. 💀

the output may be verbose, and the incurred overhead, while optimized to some extent, may still be from noticeable to significant. that's the tea. 🍵

this is only really intended for deeper investigations beyond dcstat(8), when absolutely necessary. measure and quantify the overhead in a test environment before use. fr fr, test it first. 🙈

⚠️ bestie this can be a lot of output and a lot of overhead — do not just yolo it onto production. test env first, always. 🫶

💜 SOURCE 💜

this is from bpftrace.

https://github.com/iovisor/bpftrace

also look in the bpftrace distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool. 👀

this is a bpftrace version of the bcc tool of the same name. the bcc tool may provide more options and customizations.

https://github.com/iovisor/bcc

⭐ OS ⭐

Linux. periodt. 🐧

🎀 STABILITY 🎀

Unstable - in development. she's growing, she's evolving, she's in her development era. 🌱

👑 AUTHOR 👑

Brendan Gregg

🌟 SEE ALSO 🌟

okay that's the whole page bestie, you're officially a dcache girlie now. this was dcsnoop.bt(8) from the System Manager's Manual, under the USER COMMANDS section, dated 2018-09-08. slay, go trace some lookups responsibly 💖✨🦋

📦 where this page comes from