threadsnoop(8)

1threadsnoop(8)              System Manager's Manual             threadsnoop(8)
2
3
4

NAME

6       threadsnoop.bt  - Trace thread creation via pthread_create(). Uses bpf‐
7       trace/eBPF.
8

SYNOPSIS

10       threadsnoop.bt
11

DESCRIPTION

13       threadsnoop traces calls to  pthread_create(),  showing  this  path  of
14       thread  creation.  This  can  be used for workload characterization and
15       discovery, and is a companion to execsnoop(8) which traces execve(2).
16
17       This works by tracing the pthread_create()  from  libpthread.so.0.  The
18       path  to  this  library  may need adjusting in the tool source to match
19       your system.
20
21       Since this uses BPF, only the root user can use this tool.
22

REQUIREMENTS

24       CONFIG_BPF and bpftrace.
25

EXAMPLES

27       Trace calls pthread_create():
28              # threadsnoop.bt
29

FIELDS

31       TIME(ms)
32              Elapsed time since the tool began tracing (in milliseconds).
33
34       PID    The process ID.
35
36       COMM   The process (thread) name.
37
38       FUNC   The name of the start routine, if the symbol is available,  else
39              a hex address for the start routine address.
40

OVERHEAD

42       Thread  creation  is expected to be low (<< 1000/s), so the overhead of
43       this tool is expected to be negligible.
44

SOURCE

46       This tool originated from the book "BPF Performance  Tools",  published
47       by Addison Wesley (2019):
48
49              http://www.brendangregg.com/bpf-performance-tools-book.html
50
51       See the book for more documentation on this tool.
52
53       This version is in the bpftrace repository:
54
55              https://github.com/iovisor/bpftrace
56
57       Also  look  in  the bpftrace distribution for a companion _examples.txt
58       file containing example usage, output, and commentary for this tool.
59

OS

61       Linux
62

STABILITY

64       Unstable - in development.
65

AUTHOR

67       Brendan Gregg
68