bcc-syscount(8)

1syscount(8)                 System Manager's Manual                syscount(8)
2
3
4

NAME

6       syscount - Summarize syscall counts and latencies.
7

SYNOPSIS

9       syscount  [-h]  [-p  PID] [-t TID] [-i INTERVAL] [-d DURATION] [-T TOP]
10       [-x] [-e ERRNO] [-L] [-m] [-P] [-l] [--syscall SYSCALL]
11

DESCRIPTION

13       This tool traces syscall entry and exit tracepoints and summarizes  ei‐
14       ther the number of syscalls of each type, or the number of syscalls per
15       process. It can also collect latency (invocation time) for each syscall
16       or each process.
17
18       Since this uses BPF, only the root user can use this tool.
19

REQUIREMENTS

21       CONFIG_BPF  and  bcc. Linux 4.7+ is required to attach a BPF program to
22       the raw_syscalls:sys_{enter,exit} tracepoints, used by this tool.
23

OPTIONS

25       -h     Print usage message.
26
27       -p PID Trace only this process.
28
29       -t TID Trace only this thread.
30
31       -i INTERVAL
32              Print the summary at the specified interval (in seconds).
33
34       -d DURATION
35              Total duration of trace (in seconds).
36
37       -T TOP Print only this many entries. Default: 10.
38
39       -x     Trace only failed syscalls (i.e.,  the  return  value  from  the
40              syscall was < 0).
41
42       -e ERRNO
43              Trace  only  syscalls that failed with that error (e.g. -e EPERM
44              or -e 1).
45
46       -m     Display times in milliseconds. Default: microseconds.
47
48       -P     Summarize by process and not by syscall.
49
50       -l     List the syscalls recognized  by  the  tool  (hard-coded  list).
51              Syscalls beyond this list will still be displayed, as "[unknown:
52              nnn]" where nnn is the syscall number.
53
54       --syscall SYSCALL
55              Trace this syscall only (use option -l  to  get  all  recognized
56              syscalls).
57

EXAMPLES

59       Summarize all syscalls by syscall:
60              # syscount
61
62       Summarize all syscalls by process:
63              # syscount -P
64
65       Summarize only failed syscalls:
66              # syscount -x
67
68       Summarize only syscalls that failed with EPERM:
69              # syscount -e EPERM
70
71       Trace PID 181 only:
72              # syscount -p 181
73
74       Summarize syscalls counts and latencies:
75              # syscount -L
76

FIELDS

78       PID    Process ID
79
80       COMM   Process name
81
82       SYSCALL
83              Syscall  name, or "[unknown: nnn]" for syscalls that aren't rec‐
84              ognized
85
86       COUNT  The number of events
87
88       TIME   The total elapsed time (in us or ms)
89

OVERHEAD

91       For most applications, the overhead should be manageable if  they  per‐
92       form  1000's or even 10,000's of syscalls per second. For higher rates,
93       the overhead may become considerable. For example, tracing a loop of  4
94       million  calls  to  geteuid(), slows it down by 1.85x when tracing only
95       syscall counts, and slows it down by more than 5x when tracing  syscall
96       counts  and  latencies. However, this represents a rate of >3.5 million
97       syscalls per second, which should not be typical.
98

SOURCE

100       This is from bcc.
101
102              https://github.com/iovisor/bcc
103
104       Also look in the bcc distribution for a  companion  _examples.txt  file
105       containing example usage, output, and commentary for this tool.
106

OS

108       Linux
109

STABILITY

111       Unstable - in development.
112

AUTHOR

114       Sasha Goldshtein, Rocky Xing
115