drsnoop(8)

🧚 drsnoop(8) ✨ System Manager's Manual ✨

Okay bestie, this is the manual for drsnoop, a tool for tracing direct reclaim events 💅 It's part of Linux eBPF/bcc, so it's giving low-level and I'm obsessed.

🎀 NAME

drsnoop - Trace direct reclaim events. Uses Linux eBPF/bcc. 💖

📜 SYNOPSIS

drsnoop [-h] [-T] [-U] [-p PID] [-t TID] [-u UID] [-d DURATION] [-n
name] [-v]

🔥 DESCRIPTION

Okay so drsnoop traces direct reclaim events and shows you which processes are allocing pages with direct reclaiming. It's lowkey so useful for figuring out why allocstall (/proc/vmstat) keeps climbing, and whether some critical processes are the ones causing it 👀

It works by tracing the direct reclaim events using kernel tracepoints 🦋

This makes use of a Linux 4.4 feature (bpf_perf_event_output()). For kernels older than 4.4, check the version under tools/old, which uses an older mechanism 🌸

Since this uses BPF, only the root user can use this tool. No cap, you need to be root 🙈

🧰 REQUIREMENTS

You'll need CONFIG_BPF and bcc ✨

🌈 OPTIONS

• -h — the usage message, for when you forget everything 💀
• -T — adds a timestamp column 🕐
• -U — shows the UID 🫶
• -p PID — traces only this process ID (filtered in-kernel) 🎯
• -t TID — traces only this thread ID (filtered in-kernel) 🧵
• -u UID — traces only this UID (filtered in-kernel) 👑
• -d DURATION — how long the trace runs in total, in seconds ⏳
• -n name — only prints processes whose name partially matches name 🔍
• -v — verbose mode, which also outputs the system memory state 🧠

💅 EXAMPLES

Trace all direct reclaim events:

# drsnoop

Trace all direct reclaim events, for 10 seconds only:

# drsnoop -d 10

Trace all direct reclaim events, and include timestamps:

# drsnoop -T

Show UID:

# drsnoop -U

Trace PID 181 only:

# drsnoop -p 181

Trace UID 1000 only:

# drsnoop -u 1000

Trace all direct reclaim events from processes whose name partially matches 'mond':

# drnsnoop -n mond

📋 FIELDS

• TIME(s) — when the call happened, in seconds ⏰
• UID — the User ID 🪪
• PID — the Process ID 🆔
• TID — the Thread ID 🧵
• COMM — the process name 🏷️

🌸 OVERHEAD

This traces the kernel direct reclaim tracepoints and prints output for each event. The rate is generally expected to be low (< 1000/s), so the overhead is also expected to be negligible, which is very chill 😌

🔗 SOURCE

This is from bcc 🐝

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion _examples.txt file, which has example usage, output, and commentary for this tool 📖

💻 OS

Linux 🐧

🧪 STABILITY

Unstable, still in development 🚧

👩‍💻 AUTHOR

Wenbo Zhang 🌟

---

That's the whole tea, bestie 🫶✨ Man page drsnoop(8), from the User Commands section, dated 2019-02-20 💜 Go trace something iconic 🦋💅