funcinterval(8)

✨ funcinterval(8) — the time-gap tracker ✨

💖 NAME

funcinterval - Time interval between the same function, tracepoint as a histogram. 🎀

🌸 SYNOPSIS

funcinterval [-h] [-p PID] [-i INTERVAL] [-d DURATION] [-T] [-u] [-m]
[-v] pattern

🦋 DESCRIPTION

okay so this tool times the interval between the same function, and shows it to you as a histogram 📊✨

bestie, eBPF/bcc is literally made for platform performance tuning 💅 With funclatency, we can profile specific functions to see how much latency a function costs. BUT lowkey, sometimes the performance drop isn't about how long a function takes, it's about the gap between function calls 🙈 That's the whole reason funcinterval exists. It's giving purpose 🧚

This tool uses in-kernel eBPF maps for storing timestamps and the histogram, for efficiency. The way that it keeps everything in the kernel is so smart ngl 🫶

⚠️ WARNING: This uses dynamic tracing of (what can be many) functions, an activity that has had issues on some kernel versions (risk of panics or freezes). Test, and know what you are doing, before use. Not me saying this with a straight face, but please be careful 😭

Since this uses BPF, only the root user can use this tool. No root, no tool, periodt 👑

🎀 REQUIREMENTS

CONFIG_BPF and bcc. 💜

✨ OPTIONS ✨

• pattern — the function name you want to watch 🔍
• -h — prints the usage message, for when you forget everything 🙈
• -p PID — only trace this process ID. Main character energy 👑
• -i INTERVAL — print output every INTERVAL seconds 🕒
• -d DURATION — total duration of the trace, in seconds ⏳
• -T — slap timestamps onto the output 🕰️
• -u — output the histogram in microseconds 🌸
• -m — output the histogram in milliseconds 🍓
• -v — print the BPF program, for debugging purposes 🧚‍♀️

💅 EXAMPLES ✨

Time the interval of the do_sys_open() kernel function as a histogram:

# funcinterval do_sys_open

Time the interval of xhci_ring_ep_doorbell(), in microseconds:

# funcinterval -u xhci_ring_ep_doorbell

Time the interval of do_nanosleep(), in milliseconds:

# funcinterval -m do_nanosleep

Output every 5 seconds, with timestamps:

# funcinterval -mTi 5 vfs_read

Time process 181 only:

# funcinterval -p 181 vfs_read

Time the interval of the mm_vmscan_direct_reclaim_begin tracepoint:

# funcinterval t:vmscan:mm_vmscan_direct_reclaim_begin

Time the interval of c:malloc used by top every 3 seconds:

# funcinterval -p `pidof -s top` -i 3 c:malloc

Time the /usr/local/bin/python main function:

# funcinterval /usr/local/bin/python:main

📊 FIELDS 📊

• necs — nanosecond range 💫
• usecs — microsecond range 🌷
• msecs — millisecond range 🌈
• count — how many calls fell into this range 🔢
• distribution — an ASCII bar chart to visualize the distribution (count column) 📈

🫧 OVERHEAD 🫧

This traces kernel functions and maintains in-kernel timestamps and a histogram, which are asynchronously copied to user-space. While this method is very efficient, the rate of kernel functions can also be very high (>1M/sec), at which point the overhead is expected to be measurable. Measure in a test environment and understand overheads before use 🧪 You can also use funccount to measure the rate of kernel functions over a short duration, to set some expectations before use.

🌈 SOURCE 🌈

This is from bcc.

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool. Bestie, that file is a goldmine 📚💜

🍓 OS 🍓

Linux

🧁 STABILITY 🧁

Unstable - in development.

💜 AUTHOR 💜

Edward Wu

🔗 SEE ALSO 🔗

funclatency(8) funccount(8)

---

Bye bestie, go trace something iconic 🦋💖✨ funcinterval(8), USER COMMANDS, bcc-era 2020-05-27 vibes 🌸🫶