mdflush.bt(8)

📦 version 0.17.0, in debian bookworm

✨ mdflush.bt — the manual, but make it a group chat ✨

okay bestie, so this is mdflush.bt from the System Manager's Manual 💖 it traces md flush events and it runs on bpftrace/eBPF. yes, lowercase .bt, yes it's iconic.

🌸 NAME 🌸

mdflush.bt — trace md flush events, using bpftrace/eBPF. that's the whole job. she's focused. 💅

🎀 SYNOPSIS 🎀

mdflush.bt

that's it. no args, no flags, no drama. she just goes. ✨

🦋 DESCRIPTION 🦋

so this tool traces flush events by md, which is the Linux multiple device driver (aka software RAID, iykyk). every time one of those flushes happens, it prints the timestamp and the md device for the flush. that's the tea. ☕

and why do we care?? because knowing when these flushes go down is lowkey so useful for correlating them with unexplained spikes in disk latency. like oh, your latency spiked? check the flush timing bestie, it's giving cause and effect. 🔥

the way it works: it traces the kernel md_flush_request() function using kernel dynamic tracing. and no cap, because this is dynamic tracing, it will need updating to match any changes to this function. if the kernel devs touch md_flush_request(), this tool needs a glow-up. periodt. 💀

also important: the flushes themselves are likely to originate from higher up in the I/O stack, like from the file systems. so md is often just the messenger here, not the main character. 🙈

⚠️ and because this uses BPF, only the root user can use this tool. no root, no vibes. 👑

🌈 REQUIREMENTS 🌈

  • CONFIG_BPF
  • bpftrace

that's the whole list. get both or go home. 🫶

💜 EXAMPLES 💜

Trace md flush events:

# mdflush.bt

slay. run it as root and watch the flushes roll in. ✨

🍓 FIELDS 🍓

  • TIME — when the flush event happened, formatted as HH:MM:SS.
  • PID — the process ID that was on-CPU when the event was issued. this may identify the cause of the flush (like, say, the "sync" command 👀), but ngl it'll often just identify a kernel worker thread that was managing I/O. so don't be shocked when it's not the culprit you were hoping for.
  • COMM — the command name for that PID.
  • DEVICE — the md device name. 🎀

🧚 OVERHEAD 🧚

expected to be negligible. she's light, she's polite, she barely takes up any CPU. 💅

💖 SOURCE 💖

this one's from bpftrace. 🦋

https://github.com/iovisor/bpftrace

also — and this is the good part — go look in the bpftrace distribution for a companion _examples.txt file. it's got example usage, output, and commentary for this tool. basically the director's commentary track. obsessed. 🎬

and plot twist: this is a bpftrace version of the bcc tool of the same name. the bcc tool may provide more options and customizations, so if you want extra toppings, go there:

https://github.com/iovisor/bcc

👑 OS 👑

Linux. that's the one. 🐧

⭐ STABILITY ⭐

Unstable - in development.

so like... she's still growing. be gentle. it's giving "work in progress, but make it gorgeous". 🌱

🌸 AUTHOR 🌸

Brendan Gregg

the icon. the legend. the moment. 🙌

🔥 SEE ALSO 🔥

and that's the whole page bestie, no notes. 💜 this came out of USER COMMANDS, dated 2018-09-07, and yes the manual page really is named mdflush.bt(8) — so go forth, run it as root, and stan a negligible-overhead tracer. mwah. 💅✨🎀

📦 where this page comes from