1syscount(8) System Manager's Manual syscount(8)
2
3
4
6 syscount - Summarize syscall counts and latencies.
7
9 syscount [-h] [-p PID] [-t TID] [-i INTERVAL] [-d DURATION] [-T TOP]
10 [-x] [-e ERRNO] [-L] [-m] [-P] [-l] [--syscall SYSCALL]
11
13 This tool traces syscall entry and exit tracepoints and summarizes ei‐
14 ther the number of syscalls of each type, or the number of syscalls per
15 process. It can also collect latency (invocation time) for each syscall
16 or each process.
17
18 Since this uses BPF, only the root user can use this tool.
19
21 CONFIG_BPF and bcc. Linux 4.7+ is required to attach a BPF program to
22 the raw_syscalls:sys_{enter,exit} tracepoints, used by this tool.
23
25 -h Print usage message.
26
27 -p PID Trace only this process.
28
29 -t TID Trace only this thread.
30
31 -i INTERVAL
32 Print the summary at the specified interval (in seconds).
33
34 -d DURATION
35 Total duration of trace (in seconds).
36
37 -T TOP Print only this many entries. Default: 10.
38
39 -x Trace only failed syscalls (i.e., the return value from the
40 syscall was < 0).
41
42 -e ERRNO
43 Trace only syscalls that failed with that error (e.g. -e EPERM
44 or -e 1).
45
46 -m Display times in milliseconds. Default: microseconds.
47
48 -P Summarize by process and not by syscall.
49
50 -l List the syscalls recognized by the tool (hard-coded list).
51 Syscalls beyond this list will still be displayed, as "[unknown:
52 nnn]" where nnn is the syscall number.
53
54 --syscall SYSCALL
55 Trace this syscall only (use option -l to get all recognized
56 syscalls).
57
59 Summarize all syscalls by syscall:
60 # syscount
61
62 Summarize all syscalls by process:
63 # syscount -P
64
65 Summarize only failed syscalls:
66 # syscount -x
67
68 Summarize only syscalls that failed with EPERM:
69 # syscount -e EPERM
70
71 Trace PID 181 only:
72 # syscount -p 181
73
74 Summarize syscalls counts and latencies:
75 # syscount -L
76
78 PID Process ID
79
80 COMM Process name
81
82 SYSCALL
83 Syscall name, or "[unknown: nnn]" for syscalls that aren't rec‐
84 ognized
85
86 COUNT The number of events
87
88 TIME The total elapsed time (in us or ms)
89
91 For most applications, the overhead should be manageable if they per‐
92 form 1000's or even 10,000's of syscalls per second. For higher rates,
93 the overhead may become considerable. For example, tracing a loop of 4
94 million calls to geteuid(), slows it down by 1.85x when tracing only
95 syscall counts, and slows it down by more than 5x when tracing syscall
96 counts and latencies. However, this represents a rate of >3.5 million
97 syscalls per second, which should not be typical.
98
100 This is from bcc.
101
102 https://github.com/iovisor/bcc
103
104 Also look in the bcc distribution for a companion _examples.txt file
105 containing example usage, output, and commentary for this tool.
106
108 Linux
109
111 Unstable - in development.
112
114 Sasha Goldshtein, Rocky Xing
115
117 funccount(8), ucalls(8), argdist(8), trace(8), funclatency(8)
118
119
120
121USER COMMANDS 2017-02-15 syscount(8)