1syscount(8) System Manager's Manual syscount(8)
2
3
4
6 syscount - Summarize syscall counts and latencies.
7
9 syscount [-h] [-p PID] [-i INTERVAL] [-d DURATION] [-T TOP] [-x] [-e
10 ERRNO] [-L] [-m] [-P] [-l]
11
13 This tool traces syscall entry and exit tracepoints and summarizes
14 either the number of syscalls of each type, or the number of syscalls
15 per process. It can also collect latency (invocation time) for each
16 syscall or each process.
17
18 Since this uses BPF, only the root user can use this tool.
19
21 CONFIG_BPF and bcc. Linux 4.7+ is required to attach a BPF program to
22 the raw_syscalls:sys_{enter,exit} tracepoints, used by this tool.
23
25 -h Print usage message.
26
27 -p PID Trace only this process.
28
29 -i INTERVAL
30 Print the summary at the specified interval (in seconds).
31
32 -d DURATION
33 Total duration of trace (in seconds).
34
35 -T TOP Print only this many entries. Default: 10.
36
37 -x Trace only failed syscalls (i.e., the return value from the
38 syscall was < 0).
39
40 -e ERRNO
41 Trace only syscalls that failed with that error (e.g. -e EPERM
42 or -e 1).
43
44 -m Display times in milliseconds. Default: microseconds.
45
46 -P Summarize by process and not by syscall.
47
48 -l List the syscalls recognized by the tool (hard-coded list).
49 Syscalls beyond this list will still be displayed, as "[unknown:
50 nnn]" where nnn is the syscall number.
51
53 Summarize all syscalls by syscall:
54 # syscount
55
56 Summarize all syscalls by process:
57 # syscount -P
58
59 Summarize only failed syscalls:
60 # syscount -x
61
62 Summarize only syscalls that failed with EPERM:
63 # syscount -e EPERM
64
65 Trace PID 181 only:
66 # syscount -p 181
67
68 Summarize syscalls counts and latencies:
69 # syscount -L
70
72 PID Process ID
73
74 COMM Process name
75
76 SYSCALL
77 Syscall name, or "[unknown: nnn]" for syscalls that aren't rec‐
78 ognized
79
80 COUNT The number of events
81
82 TIME The total elapsed time (in us or ms)
83
85 For most applications, the overhead should be manageable if they per‐
86 form 1000's or even 10,000's of syscalls per second. For higher rates,
87 the overhead may become considerable. For example, tracing a loop of 4
88 million calls to geteuid(), slows it down by 1.85x when tracing only
89 syscall counts, and slows it down by more than 5x when tracing syscall
90 counts and latencies. However, this represents a rate of >3.5 million
91 syscalls per second, which should not be typical.
92
94 This is from bcc.
95
96 https://github.com/iovisor/bcc
97
98 Also look in the bcc distribution for a companion _examples.txt file
99 containing example usage, output, and commentary for this tool.
100
102 Linux
103
105 Unstable - in development.
106
108 Sasha Goldshtein
109
111 funccount(8), ucalls(8), argdist(8), trace(8), funclatency(8)
112
113
114
115USER COMMANDS 2017-02-15 syscount(8)