bcc-funccount(8)

1funccount(8)                System Manager's Manual               funccount(8)
2
3
4

NAME

6       funccount - Count function, tracepoint, and USDT probe calls matching a
7       pattern. Uses Linux eBPF/bcc.
8

SYNOPSIS

10       funccount [-h] [-p PID] [-i INTERVAL] [-d DURATION] [-T] [-r] [-c  CPU]
11       [-D] pattern
12

DESCRIPTION

14       This tool is a quick way to determine which functions are being called,
15       and at what rate. It uses in-kernel eBPF maps to count function calls.
16
17       WARNING: This uses dynamic tracing of (what can be many) functions,  an
18       activity that has had issues on some kernel versions (risk of panics or
19       freezes). Test, and know what you are doing, before use.
20
21       Since this uses BPF, only the root user can use this tool.
22

REQUIREMENTS

24       CONFIG_BPF and bcc.
25

OPTIONS

27       pattern Search pattern. Supports "*" wildcards. See EXAMPLES.  You  can
28       also use -r for regular expressions.
29
30       -h     Print usage message.
31
32       -p PID Trace this process ID only.
33
34       -i INTERVAL
35              Print output every interval seconds.
36
37       -d DURATION
38              Total duration of trace in seconds.
39
40       -T     Include timestamps on output.
41
42       -r     Use regular expressions for the search pattern.
43
44       -D     Print the BPF program before starting (for debugging purposes).
45
46       -c CPU Trace on this CPU only.
47

EXAMPLES

49       Count kernel functions beginning with "vfs_", until Ctrl-C is hit:
50              # funccount 'vfs_*'
51
52       Count kernel functions beginning with "tcp_send", until Ctrl-C is hit:
53              # funccount 'tcp_send*'
54
55       Print kernel functions beginning with "vfs_", every second:
56              # funccount -i 1 'vfs_*'
57
58       Print kernel functions beginning with "vfs_", for ten seconds only:
59              # funccount -d 10 'vfs_*'
60
61       Match  kernel  functions  beginning  with "vfs_", using regular expres‐
62       sions:
63              # funccount -r '^vfs_.*'
64
65       Count vfs calls for process ID 181 only:
66              # funccount -p 181 'vfs_*'
67
68       Count calls to the sched_fork  tracepoint,  indicating  a  fork()  per‐
69       formed:
70              # funccount t:sched:sched_fork
71
72       Count all GC USDT probes in the Node process:
73              # funccount -p 185 u:node:gc*
74
75       Count all malloc() calls in libc:
76              # funccount c:malloc
77
78       Count kernel functions beginning with "vfs_" on CPU 1 only:
79              # funccount -c 1 'vfs_*'
80

FIELDS

82       FUNC   Function name
83
84       COUNT  Number of calls while tracing
85

OVERHEAD

87       This  traces  functions and maintains in-kernel counts, which are asyn‐
88       chronously copied to user-space. While the rate of calls be  very  high
89       (>1M/sec),  this  is  a relatively efficient way to trace these events,
90       and so the overhead is expected to be small for normal workloads.  Mea‐
91       sure in a test environment before use.
92

SOURCE

94       This is from bcc.
95
96              https://github.com/iovisor/bcc
97
98       Also  look  in  the bcc distribution for a companion _examples.txt file
99       containing example usage, output, and commentary for this tool.
100

OS

102       Linux
103

STABILITY

105       Unstable - in development.
106

AUTHOR

108       Brendan Gregg, Sasha Goldshtein
109