syncsnoop(8)

1syncsnoop(8)                System Manager's Manual               syncsnoop(8)
2
3
4

NAME

6       syncsnoop.bt  -  Trace  the  sync()  variety  of  syscalls.  Uses  bpf‐
7       trace/eBPF.
8

SYNOPSIS

10       syncsnoop.bt
11

DESCRIPTION

13       syncsnoop traces calls to sync() syscalls  (sync(),  fsync(),  msync(),
14       etc),  which  flushes file system cache and buffers to storage devices.
15       These calls can cause performance perturbations, and it can  be  useful
16       to know if they are happening, when they happen, and how frequently.
17
18       This works by tracing the sync() variety of syscalls via tracepoints.
19
20       This program is also a basic example of eBPF/bcc.
21
22       Since this uses BPF, only the root user can use this tool.
23

REQUIREMENTS

25       CONFIG_BPF and bpftrace.
26

EXAMPLES

28       Trace calls to sync() syscalls:
29              # syncsnoop.bt
30

FIELDS

32       TIME   A timestamp on the output, in "HH:MM:SS" format.
33
34       PID    The process ID that was on-CPU during the event.
35
36       COMM   The process name that was on-CPU during the event.
37
38       EVENT  The tracepoint name for the sync event.
39

OVERHEAD

41       This traces sync syscalls and prints output for each event. As the rate
42       of this is generally expected to be low (<<  100/s),  the  overhead  is
43       also expected to be negligible.
44

SOURCE

46       This is from bpftrace.
47
48              https://github.com/iovisor/bpftrace
49
50       Also  look  in  the bpftrace distribution for a companion _examples.txt
51       file containing example usage, output, and commentary for this tool.
52
53       This is a bpftrace version of the bcc tool of the same name.
54
55              https://github.com/iovisor/bcc
56

OS

58       Linux
59

STABILITY

61       Unstable - in development.
62

AUTHOR

64       Brendan Gregg
65