bcc-funccount(8)

1funccount(8)                System Manager's Manual               funccount(8)
2
3
4

NAME

6       funccount - Count function, tracepoint, and USDT probe calls matching a
7       pattern. Uses Linux eBPF/bcc.
8

SYNOPSIS

10       funccount [-h] [-p PID] [-i INTERVAL] [-d DURATION] [-T] [-r] [-D] pat‐
11       tern
12

DESCRIPTION

14       This tool is a quick way to determine which functions are being called,
15       and at what rate. It uses in-kernel eBPF maps to count function calls.
16
17       WARNING: This uses dynamic tracing of (what can be many) functions,  an
18       activity that has had issues on some kernel versions (risk of panics or
19       freezes). Test, and know what you are doing, before use.
20
21       Since this uses BPF, only the root user can use this tool.
22

REQUIREMENTS

24       CONFIG_BPF and bcc.
25

OPTIONS

27       pattern Search pattern. Supports "*" wildcards. See EXAMPLES.  You  can
28       also use -r for regular expressions.
29
30       -h     Print usage message.
31
32       -p PID Trace this process ID only.
33
34       -i INTERVAL
35              Print output every interval seconds.
36
37       -d DURATION
38              Total duration of trace in seconds.
39
40       -T     Include timestamps on output.
41
42       -r     Use regular expressions for the search pattern.
43
44       -D     Print the BPF program before starting (for debugging purposes).
45

EXAMPLES

47       Count kernel functions beginning with "vfs_", until Ctrl-C is hit:
48              # funccount 'vfs_*'
49
50       Count kernel functions beginning with "tcp_send", until Ctrl-C is hit:
51              # funccount 'tcp_send*'
52
53       Print kernel functions beginning with "vfs_", every second:
54              # funccount -i 1 'vfs_*'
55
56       Print kernel functions beginning with "vfs_", for ten seconds only:
57              # funccount -d 10 'vfs_*'
58
59       Match  kernel  functions  beginning  with "vfs_", using regular expres‐
60       sions:
61              # funccount -r '^vfs_.*'
62
63       Count vfs calls for process ID 181 only:
64              # funccount -p 181 'vfs_*'
65
66       Count calls to the sched_fork  tracepoint,  indicating  a  fork()  per‐
67       formed:
68              # funccount t:sched:sched_fork
69
70       Count all GC USDT probes in the Node process:
71              # funccount -p 185 u:node:gc*
72
73       Count all malloc() calls in libc:
74              # funccount c:malloc
75

FIELDS

77       FUNC   Function name
78
79       COUNT  Number of calls while tracing
80

OVERHEAD

82       This  traces  functions and maintains in-kernel counts, which are asyn‐
83       chronously copied to user-space. While the rate of calls be  very  high
84       (>1M/sec),  this  is  a relatively efficient way to trace these events,
85       and so the overhead is expected to be small for normal workloads.  Mea‐
86       sure in a test environment before use.
87

SOURCE

89       This is from bcc.
90
91              https://github.com/iovisor/bcc
92
93       Also  look  in  the bcc distribution for a companion _examples.txt file
94       containing example usage, output, and commentary for this tool.
95

OS

97       Linux
98

STABILITY

100       Unstable - in development.
101

AUTHOR

103       Brendan Gregg, Sasha Goldshtein
104