dcsnoop.bt(8)

💖 dcsnoop.bt(8) ✨ System Manager's Manual 💖

🎀 NAME

okay so dcsnoop.bt is the tool that traces directory entry cache (dcache) lookups 👀 It's built on bpftrace/eBPF, so it's giving low-level kernel detective vibes 🔍🦋

🌸 SYNOPSIS

dcsnoop.bt

✨ DESCRIPTION

bestie, by default this traces every dcache lookup 😭 and shows you which process did the lookup and what filename it asked for 📂💅

the output can get super verbose 🙈 so it's meant for digging deeper into dcache performance beyond what dcstat(8) shows you. dcstat is the one that prints per-second summaries, so think of it as the big-picture friend and dcsnoop as the one who goes full detective mode 🕵️‍♀️

this uses kernel dynamic tracing of the d_lookup() function. ngl that means it's tied to that function, so it will need updating whenever that function changes 🔧

and since this runs on BPF, only the root user can use it. no cap, you need to be root 👑

---

🧚 REQUIREMENTS

you'll need CONFIG_BPF and bcc ready to go 🍓

💜 EXAMPLES

Trace all dcache lookups:

# dcsnoop.bt

🦋 FIELDS

• TIME(ms) — the time of the lookup, in milliseconds ⏰
• PID — the process ID 🆔
• COMM — the process name 🏷️
• T — the type: R means reference, M means miss 💀 a miss prints two lines, one for the reference and one for the miss, so don't panic when you see double 😭
• FILE — the file name component being looked up 📄 this can include trailing pathname components (anything after a /), and those become the subject of later lookups, so it's like a chain of lookups bestie 🔗

🔥 OVERHEAD

okay this part is important, so listen up 👂 file name lookups can be super frequent depending on the workload 🌊 this tool prints a line for every failed lookup, and if you add -a, it prints every reference too 😱 the output can be verbose, and the overhead, even though it's optimized to some extent, can go anywhere from noticeable to significant 💀

so this is really only for deeper investigations past what dcstat(8) gives you, and only when you absolutely need it 🫶 measure and quantify the overhead in a test environment before using it. trust me on this one 🙏

⚠️ seriously, don't just run this on prod and hope for the best. test it first!

🌈 SOURCE

this comes from bpftrace 🌟

https://github.com/bpftrace/bpftrace

also look in the bpftrace distribution for a companion _examples.txt file. it has example usage, output, and commentary for this tool, which is lowkey a must-read 📖

this is the bpftrace version of the bcc tool with the same name. the bcc tool might have more options and customizations if you need extra power 💪

https://github.com/iovisor/bcc

🖥️ OS

Linux 🐧

🚧 STABILITY

Unstable - in development. so it's still a work in progress, be gentle with it 🥺

👑 AUTHOR

written by Brendan Gregg 💖

🫧 SEE ALSO

• dcstat(8) 🔗

---

ok bestie that's the whole thing 💅✨ this page is from the USER COMMANDS section, dated 2018-09-08, and it's all about dcsnoop.bt(8) 🌸 stay curious and stay iconic 🦋💜