syncsnoop.bt(8)

📦 version 0.17.0, in debian bookworm

✨ syncsnoop.bt — bestie edition ✨

okay so real quick: this is a page from the System Manager's Manual (section 8, the big-user one 💅), and it's all about syncsnoop.bt. welcome to the group chat, pull up a chair 🫶

🌸 NAME 🌸

syncsnoop.bt — trace the sync() variety of syscalls. uses bpftrace/eBPF. no cap, that's literally the whole vibe.

🎀 SYNOPSIS 🎀

syncsnoop.bt

that's it. that's the whole invocation. iconic, honestly.

💖 DESCRIPTION 💖

so syncsnoop traces calls to the sync() syscalls — think sync(), fsync(), msync(), etc. those are the ones that flush the file system cache and buffers out to the storage devices. and bestie, when those fire, they can cause performance perturbations 😭. so it's genuinely useful to know if they're happening, when they're happening, and how frequently they're happening.

the way it works? it traces the sync() variety of syscalls via tracepoints. that's the whole trick. slay.

this program is also a basic example of eBPF/bcc — so if you're trying to learn what this stuff looks like, it's giving tutorial energy ✨.

⚠️ heads up: since this uses BPF, only the root user can use this tool. no root, no snooping. sorry bestie 💀

🦋 REQUIREMENTS 🦋

  • CONFIG_BPF
  • bpftrace

both of them. neither is optional. periodt.

🌈 EXAMPLES 🌈

trace calls to sync() syscalls:

# syncsnoop.bt

one command, zero notes. she's simple like that 💅

⭐ FIELDS ⭐

okay so when the output shows up, here's what each column is actually telling you:

  • TIME — a timestamp on the output, in "HH:MM:SS" format.
  • PID — the process ID that was on-CPU during the event.
  • COMM — the process name that was on-CPU during the event.
  • EVENT — the tracepoint name for the sync event.

four little columns of truth 🫶

🔥 OVERHEAD 🔥

this traces sync syscalls and prints output for each event. and because the rate of this is generally expected to be low (<< 100/s), the overhead is also expected to be negligible. tiny. a crumb. nothing to worry about 🌸

🧚 SOURCE 🧚

this is from bpftrace.

https://github.com/iovisor/bpftrace

also, do yourself a favor and look in the bpftrace distribution for a companion _examples.txt file — it's got example usage, output, and commentary for this tool. lowkey a whole extra resource, use it 💜

and fyi: this is a bpftrace version of the bcc tool of the same name.

https://github.com/iovisor/bcc

👑 OS 👑

Linux. that's the one. 🐧

💀 STABILITY 💀

Unstable - in development.

so like. she's in her development era. treat accordingly 🙈

💜 AUTHOR 💜

Brendan Gregg

thank you for your service, legend 🫡

🌟 SEE ALSO 🌟

go read that one too, it's a whole other thing iykyk.

that's the page bestie!! this came out of the USER COMMANDS part of the System Manager's Manual, and the version/date stamped on it is 2018-09-06 💖 go forth and trace those syncs, and remember: root only, low overhead, main character energy only 🌈✨🎀

📦 where this page comes from