syscount.bt(8)

📦 version 0.17.0, in debian bookworm

💖 syscount.bt(8) — System Manager's Manual 💖

okay bestie, welcome to the syscount.bt page, part of the System Manager's Manual section 8 (that's the "system administration / privileged commands" girlies, iykyk). it counts system calls. yes. that's the whole vibe. let's GO 🦋

✨ NAME ✨

syscount.bt — counts system calls. uses bpftrace/eBPF. that's it, that's the function, periodt 💅

✨ SYNOPSIS ✨

syscount.bt

literally no arguments, no flags, no drama. she just runs. 👑

✨ DESCRIPTION ✨

so what this does is count system calls (syscalls, for the short version), and when you're done it prints a little summary: the top ten syscall IDs, and the top ten process names that were out there making syscalls. why do you care? because it's genuinely helpful for characterizing your kernel and your resource workload, and for finding the applications that are using syscalls inefficiently — like, girl, why are you calling that 4 million times, it's giving chaotic 🙈

the way it works under the hood: it hooks the tracepoint:raw_syscalls:sys_enter tracepoint. that's the plug, that's where the magic enters the chat ✨

and because this uses BPF, only the root user can use this tool. no root, no counting. sorry bestie, house rules 🚫

✨ REQUIREMENTS ✨

  • CONFIG_BPF
  • bpftrace

that's the whole list. if you've got both, you're slaying. 🎀

✨ EXAMPLES ✨

count system calls until you hit Ctrl-C:

# syscount.bt

yeah that's the example. she's simple. she's effective. she's iconic. 🌸

✨ OUTPUT ✨

Top 10 syscalls IDs:

this one shows you the syscall ID number — it lives in @syscall[] — followed by a count of how many times that syscall happened during tracing. now, if you want to know the actual name for that ID, you've got options: you can use ausyscall --dump, or you can go use the bcc version of this tool, which does the translations for you. the raw IDs stay raw here, no cap. 💜

Top 10 processes:

this one shows you the process name — that one lives in @process[] — followed by a count of syscalls during tracing. cute, concise, tells you exactly which process is being the loudest in the group chat. 😭

✨ OVERHEAD ✨

okay this is the part where we get real, because overhead is not a joke and I need you to hear me. 🫶

for most applications, the overhead should be manageable if they perform 1000's or even 10,000's of syscalls per second. that's fine. that's normal. that's a chill workload.

for higher rates, though? the overhead may become considerable. for example: tracing a microbenchmark loop of 4 million calls to geteuid() slows it down by 2.4x. yeah. 😭

but — and this is the important caveat, don't skip it — that represents tracing a workload that has a syscall rate of over 4 million syscalls per second per CPU, which should not be typical. in one large cloud production environment, rates of between 10k and 50k are typical, and at those rates the application overhead is expected to be closer to 1%. so like, breathe. it's usually fine. 💖

and for comparison, because the girlies love a comparison: strace(1) in its current ptrace-based implementation (which it has had for decades, mind you) runs the same geteuid() workload 102x slower. that's one hundred and two times slower. 102. one. hundred. two. 💀

✨ SOURCE ✨

this is from bpftrace.

https://github.com/iovisor/bpftrace

also, go look in the bpftrace distribution for a companion _examples.txt file — it's got example usage, output, and commentary for this tool. free bonus content, we love that. ⭐

this is a bpftrace version of the bcc tool of the same name. heads up though: the bcc version provides different command line options, AND it translates the syscall IDs to their syscall names. so they're sisters, not twins. 🌈

https://github.com/iovisor/bcc

✨ OS ✨

Linux

✨ STABILITY ✨

Unstable - in development.

so like, she's in her experimental era. be gentle. 🧚

✨ AUTHOR ✨

Brendan Gregg

✨ SEE ALSO ✨

and that's the whole page bestie, you ate it, you understood it, you're basically a kernel engineer now 👑

cute little sign-off for you: this one came out of the USER COMMANDS crew on 2018-09-06, filed under syscount.bt(8). go count something. responsibly. as root. 💖✨🎀

📦 where this page comes from