dcsnoop(8)

💖 dcsnoop(8) — the dcache snoop tool 💖

okay bestie, this is the manual for dcsnoop, the tool that spies on your directory entry cache (dcache) lookups 🕵️‍♀️✨

✨ NAME ✨

dcsnoop — trace directory entry cache (dcache) lookups. It uses Linux eBPF/bcc 🦋

✨ SYNOPSIS ✨

dcsnoop [-h] [-a]

✨ DESCRIPTION ✨

okay so by default, this traces every failed dcache lookup (a cache miss) 💀. For each one it shows the process doing the lookup and the filename it asked for. want to see everything instead? use -a and it'll show all lookups, not just the failed ones 👀

the output can get pretty verbose, so it's really meant for deeper digging into dcache performance after you've checked in with dcstat(8), which gives you per-second summaries 🌸

this works by dynamically tracing the d_lookup() function in the kernel. it'll need updating whenever that function changes, so keep that in mind 🔧

also, since this uses BPF, only the root user can run this tool 👑 not me being dramatic, it's a hard rule 🙈

✨ REQUIREMENTS ✨

you need CONFIG_BPF in your kernel, plus bcc 🧚

✨ OPTIONS ✨

• -h — prints the usage message 📖
• -a — traces references too, not just the failed lookups 🔍

✨ EXAMPLES ✨

trace failed dcache lookups:

# dcsnoop

trace all dcache lookups:

# dcsnoop -a

✨ FIELDS ✨

here's what shows up in the output, bestie 📋

• TIME(s) — when the lookup happened, in seconds ⏰
• PID — the process ID 🆔
• COMM — the process name 🎀
• T — the type: R means reference (only shows up with -a), and M means miss. a miss prints two lines, one for the reference and one for the miss, so don't panic when you see doubles 😭
• FILE — the filename component that was being looked up. it can include trailing pathname components (the bits after a /), and those become the subject of the lookups that come next 🗂️

✨ OVERHEAD ✨

⚠️ heads up, this one matters! file name lookups can happen a LOT depending on the workload, and this tool prints a line for every failed lookup. with -a it prints every reference as well 😱 the output can be verbose, and even though it's optimized to some extent, the overhead can go from noticeable all the way to significant 💅 this is only really for deeper investigations beyond dcstat(8), and only when you absolutely need it. measure and quantify the overhead in a test environment before using it 🫶

✨ SOURCE ✨

this comes from bcc 🌈 you can find it at:

https://github.com/iovisor/bcc

also check the bcc distribution for a companion file called _examples.txt. it has example usage, output, and commentary for this tool 📚

✨ OS ✨

Linux 🐧

✨ STABILITY ✨

Unstable — still in development 🚧

✨ AUTHOR ✨

Brendan Gregg 👑

✨ SEE ALSO ✨

dcstat(1) 🔗

---

and that's the tea, bestie 🫖💜 this page is from the USER COMMANDS section, dated 2016-02-10, and it's all about dcsnoop(8) 🎀✨ stay iconic and keep those caches warm 🌸💅