bcc-threadsnoop(8)

1threadsnoop(8)              System Manager's Manual             threadsnoop(8)
2
3
4

NAME

6       threadsnoop   -   Trace  thread  creation  via  pthread_create().  Uses
7       BCC/eBPF.
8

SYNOPSIS

10       threadsnoop
11

DESCRIPTION

13       threadsnoop traces calls to  pthread_create(),  showing  this  path  of
14       thread  creation.  This  can  be used for workload characterization and
15       discovery, and is a companion to execsnoop(8) which traces execve(2).
16
17       This works by tracing the pthread_create()  from  libpthread.so.0.  The
18       path  to  this  library  may need adjusting in the tool source to match
19       your system.
20
21       Since this uses BPF, only the root user can use this tool.
22

REQUIREMENTS

24       CONFIG_BPF and BCC.
25

EXAMPLES

27       Trace calls pthread_create():
28              # threadsnoop
29

FIELDS

31       TIME(ms)
32              Elapsed time since the tool began tracing (in milliseconds).
33
34       PID    The process ID.
35
36       COMM   The process (thread) name.
37
38       FUNC   The name of the start routine, if the symbol is available,  else
39              a hex address for the start routine address.
40

OVERHEAD

42       Thread  creation  is expected to be low (<< 1000/s), so the overhead of
43       this tool is expected to be negligible.
44

SOURCE

46       This originated as a bpftrace  tool  from  the  book  "BPF  Performance
47       Tools", published by Addison Wesley (2019):
48
49              http://www.brendangregg.com/bpf-performance-tools-book.html
50
51       See the book for more documentation on this tool.
52
53       This version is in the BCC repository:
54
55              https://github.com/iovisor/bcc
56
57       Also  look  in  the bcc distribution for a companion _examples.txt file
58       containing example usage, output, and commentary for this tool.
59

OS

61       Linux
62

STABILITY

64       Unstable - in development.
65

AUTHOR

67       Brendan Gregg
68