bcc-syscount(8)

1syscount(8)                 System Manager's Manual                syscount(8)
2
3
4

NAME

6       syscount - Summarize syscall counts and latencies.
7

SYNOPSIS

9       syscount  [-h]  [-p  PID] [-i INTERVAL] [-d DURATION] [-T TOP] [-x] [-e
10       ERRNO] [-L] [-m] [-P] [-l]
11

DESCRIPTION

13       This tool traces syscall entry  and  exit  tracepoints  and  summarizes
14       either  the  number of syscalls of each type, or the number of syscalls
15       per process. It can also collect latency  (invocation  time)  for  each
16       syscall or each process.
17
18       Since this uses BPF, only the root user can use this tool.
19

REQUIREMENTS

21       CONFIG_BPF  and  bcc. Linux 4.7+ is required to attach a BPF program to
22       the raw_syscalls:sys_{enter,exit} tracepoints, used by this tool.
23

OPTIONS

25       -h     Print usage message.
26
27       -p PID Trace only this process.
28
29       -i INTERVAL
30              Print the summary at the specified interval (in seconds).
31
32       -d DURATION
33              Total duration of trace (in seconds).
34
35       -T TOP Print only this many entries. Default: 10.
36
37       -x     Trace only failed syscalls (i.e.,  the  return  value  from  the
38              syscall was < 0).
39
40       -e ERRNO
41              Trace  only  syscalls that failed with that error (e.g. -e EPERM
42              or -e 1).
43
44       -m     Display times in milliseconds. Default: microseconds.
45
46       -P     Summarize by process and not by syscall.
47
48       -l     List the syscalls recognized  by  the  tool  (hard-coded  list).
49              Syscalls beyond this list will still be displayed, as "[unknown:
50              nnn]" where nnn is the syscall number.
51

EXAMPLES

53       Summarize all syscalls by syscall:
54              # syscount
55
56       Summarize all syscalls by process:
57              # syscount -P
58
59       Summarize only failed syscalls:
60              # syscount -x
61
62       Summarize only syscalls that failed with EPERM:
63              # syscount -e EPERM
64
65       Trace PID 181 only:
66              # syscount -p 181
67
68       Summarize syscalls counts and latencies:
69              # syscount -L
70

FIELDS

72       PID    Process ID
73
74       COMM   Process name
75
76       SYSCALL
77              Syscall name, or "[unknown: nnn]" for syscalls that aren't  rec‐
78              ognized
79
80       COUNT  The number of events
81
82       TIME   The total elapsed time (in us or ms)
83

OVERHEAD

85       For  most  applications, the overhead should be manageable if they per‐
86       form 1000's or even 10,000's of syscalls per second. For higher  rates,
87       the  overhead may become considerable. For example, tracing a loop of 4
88       million calls to geteuid(), slows it down by 1.85x  when  tracing  only
89       syscall  counts, and slows it down by more than 5x when tracing syscall
90       counts and latencies. However, this represents a rate of  >3.5  million
91       syscalls per second, which should not be typical.
92

SOURCE

94       This is from bcc.
95
96              https://github.com/iovisor/bcc
97
98       Also  look  in  the bcc distribution for a companion _examples.txt file
99       containing example usage, output, and commentary for this tool.
100

OS

102       Linux
103

STABILITY

105       Unstable - in development.
106

AUTHOR

108       Sasha Goldshtein
109