bcc-dcsnoop(8)

1dcsnoop(8)                  System Manager's Manual                 dcsnoop(8)
2
3
4

NAME

6       dcsnoop  -  Trace  directory  entry  cache (dcache) lookups. Uses Linux
7       eBPF/bcc.
8

SYNOPSIS

10       dcsnoop [-h] [-a]
11

DESCRIPTION

13       By default, this traces every failed dcache lookup  (cache  miss),  and
14       shows  the  process performing the lookup and the filename requested. A
15       -a option can be used to show all lookups, not just failed ones.
16
17       The output of this tool can be verbose, and  is  intended  for  further
18       investigations  of  dcache  performance  beyond dcstat(8), which prints
19       per-second summaries.
20
21       This uses kernel dynamic tracing of the d_lookup() function,  and  will
22       need and will need updating to match any changes to this function.
23
24       Since this uses BPF, only the root user can use this tool.
25

REQUIREMENTS

27       CONFIG_BPF and bcc.
28

OPTIONS

30       -h     Print usage message.
31
32       -a     Trace references, not just failed lookups.
33

EXAMPLES

35       Trace failed dcache lookups:
36              # dcsnoop
37
38       Trace all dcache lookups:
39              # dcsnoop -a
40

FIELDS

42       TIME(s)
43              Time of lookup, in seconds.
44
45       PID    Process ID.
46
47       COMM   Process name.
48
49       T      Type:  R  == reference (only visible with -a), M == miss. A miss
50              will print two lines, one for the reference,  and  one  for  the
51              miss.
52
53       FILE   The  file name component that was being looked up. This contains
54              trailing pathname components (after '/'), which will be the sub‐
55              ject of subsequent lookups.
56

OVERHEAD

58       File name lookups can be frequent (depending on the workload), and this
59       tool prints a line for each failed lookup, and with -a, each  reference
60       as  well.  The  output may be verbose, and the incurred overhead, while
61       optimized to some extent, may still be from noticeable to  significant.
62       This   is   only  really  intended  for  deeper  investigations  beyond
63       dcstat(8), when absolutely necessary.  Measure and quantify  the  over‐
64       head in a test environment before use.
65

SOURCE

67       This is from bcc.
68
69              https://github.com/iovisor/bcc
70
71       Also  look  in  the bcc distribution for a companion _examples.txt file
72       containing example usage, output, and commentary for this tool.
73

OS

75       Linux
76

STABILITY

78       Unstable - in development.
79

AUTHOR

81       Brendan Gregg
82