drsnoop(8)

🌸 NAME 🌸

okay bestie, meet drsnoop — Trace direct reclaim events. Uses Linux eBPF/bcc. This is the drsnoop(8) page from the System Manager's Manual, and it’s here to help you understand the direct-reclaim tea 💖.

✨ SYNOPSIS ✨

drsnoop [-h] [-T] [-U] [-p PID] [-t TID] [-u UID] [-d DURATION] [-n name] [-v]

🦋 DESCRIPTION 🦋

okay so drsnoop traces direct reclaim events, showing which processes are allocing pages with direct reclaiming. This can be useful for discovering when allocstall (/proc/vmstat) continues to increase, whether it is caused by some critical processes or not. That’s the whole “who is causing the memory-pressure moment” vibe check 👀.

It works by tracing the direct reclaim events using kernel tracepoints. Lowkey elegant, highkey useful ✨.

This makes use of a Linux 4.4 feature (bpf_perf_event_output()); for kernels older than 4.4, see the version under tools/old, which uses an older mechanism.

Since this uses BPF, only the root user can use this tool. No cap, bestie — root only 👑.

🎀 REQUIREMENTS 🎀

CONFIG_BPF and bcc. That’s the requirement stack, periodt 🫶.

💅 OPTIONS 💅

• -h — print usage message.
• -T — include a timestamp column.
• -U — show UID.
• -p PID — trace this process ID only (filtered in-kernel).
• -t TID — trace this thread ID only (filtered in-kernel).
• -u UID — trace this UID only (filtered in-kernel).
• -d DURATION — total duration of trace in seconds.
• -n name — only print processes where its name partially matches name. (The original page glues a -v verbose bit onto this line; keep reading, bestie 😭.)
• -v — verbose. Run in verbose mode. Will output system memory state.
• -v — show system memory state. Yes, the page lists -v twice; both lines are part of the original, so we’re keeping both 💅.

🔥 EXAMPLES 🔥

Trace all direct reclaim events:

# drsnoop

Trace all direct reclaim events, for 10 seconds only:

# drsnoop -d 10

Trace all direct reclaim events, and include timestamps:

# drsnoop -T

Show UID:

# drsnoop -U

Trace PID 181 only:

# drsnoop -p 181

Trace UID 1000 only:

# drsnoop -u 1000

Trace all direct reclaim events from processes where its name partially matches 'mond':

# drnsnoop -n mond

Yep, that command says drnsnoop — we’re copying it exactly as the page has it 🙈.

🌈 FIELDS 🌈

• TIME(s) — time of the call, in seconds.
• UID — User ID.
• PID — Process ID.
• TID — Thread ID.
• COMM — Process name.

🍓 OVERHEAD 🍓

This traces the kernel direct reclaim tracepoints and prints output for each event. As the rate of this is generally expected to be low (< 1000/s), the overhead is also expected to be negligible. So like, chill — it’s not trying to eat your CPU for breakfast 🍓.

🧚 SOURCE 🧚

This is from bcc.

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool. It’s giving documentation bestie 🧚.

💜 OS 💜

Linux.

⭐ STABILITY ⭐

Unstable - in development. That’s the status, bestie — in development, so treat it accordingly ⭐.

👑 AUTHOR 👑

Wenbo Zhang. Iconic 👑.

---

xoxo 🫶 — that’s the drsnoop(8) page, signed off under USER COMMANDS on 2019-02-20 💅✨