dcsnoop(8)

1dcsnoop(8)                  System Manager's Manual                 dcsnoop(8)
2
3
4

NAME

6       dcsnoop.bt  -  Trace  directory entry cache (dcache) lookups. Uses bpf‐
7       trace/eBPF.
8

SYNOPSIS

10       dcsnoop.bt
11

DESCRIPTION

13       By default, this traces every dcache lookup, and shows the process per‐
14       forming the lookup and the filename requested.
15
16       The  output  of  this  tool can be verbose, and is intended for further
17       investigations of dcache performance  beyond  dcstat(8),  which  prints
18       per-second summaries.
19
20       This  uses  kernel dynamic tracing of the d_lookup() function, and will
21       need and will need updating to match any changes to this function.
22
23       Since this uses BPF, only the root user can use this tool.
24

REQUIREMENTS

26       CONFIG_BPF and bcc.
27

EXAMPLES

29       Trace all dcache lookups:
30              # dcsnoop.bt
31

FIELDS

33       TIME(ms)
34              Time of lookup, in milliseconds.
35
36       PID    Process ID.
37
38       COMM   Process name.
39
40       T      Type: R == reference, M == miss. A miss will  print  two  lines,
41              one for the reference, and one for the miss.
42
43       FILE   The  file name component that was being looked up. This contains
44              trailing pathname components (after '/'), which will be the sub‐
45              ject of subsequent lookups.
46

OVERHEAD

48       File name lookups can be frequent (depending on the workload), and this
49       tool prints a line for each failed lookup, and with -a, each  reference
50       as  well.  The  output may be verbose, and the incurred overhead, while
51       optimized to some extent, may still be from noticeable to  significant.
52       This   is   only  really  intended  for  deeper  investigations  beyond
53       dcstat(8), when absolutely necessary.  Measure and quantify  the  over‐
54       head in a test environment before use.
55

SOURCE

57       This is from bpftrace.
58
59              https://github.com/iovisor/bpftrace
60
61       Also  look  in  the bpftrace distribution for a companion _examples.txt
62       file containing example usage, output, and commentary for this tool.
63
64       This is a bpftrace version of the bcc tool of the same  name.  The  bcc
65       tool may provide more options and customizations.
66
67              https://github.com/iovisor/bcc
68

OS

70       Linux
71

STABILITY

73       Unstable - in development.
74

AUTHOR

76       Brendan Gregg
77