bcc-syscount(8)

1syscount(8)                 System Manager's Manual                syscount(8)
2
3
4

NAME

6       syscount - Summarize syscall counts and latencies.
7

SYNOPSIS

9       syscount  [-h]  [-p PID] [-t TID] [-c PPID] [-i INTERVAL] [-d DURATION]
10       [-T TOP] [-x] [-e ERRNO] [-L] [-m] [-P] [-l] [--syscall SYSCALL]
11

DESCRIPTION

13       This tool traces syscall entry and exit tracepoints and summarizes  ei‐
14       ther the number of syscalls of each type, or the number of syscalls per
15       process. It can also collect latency (invocation time) for each syscall
16       or each process.
17
18       Since this uses BPF, only the root user can use this tool.
19

REQUIREMENTS

21       CONFIG_BPF  and  bcc. Linux 4.7+ is required to attach a BPF program to
22       the raw_syscalls:sys_{enter,exit} tracepoints, used by this tool.
23

OPTIONS

25       -h     Print usage message.
26
27       -p PID Trace only this process.
28
29       -t TID Trace only this thread.
30
31       -c PPID
32              Trace only child of this pid.
33
34       -i INTERVAL
35              Print the summary at the specified interval (in seconds).
36
37       -d DURATION
38              Total duration of trace (in seconds).
39
40       -T TOP Print only this many entries. Default: 10.
41
42       -x     Trace only failed syscalls (i.e.,  the  return  value  from  the
43              syscall was < 0).
44
45       -e ERRNO
46              Trace  only  syscalls that failed with that error (e.g. -e EPERM
47              or -e 1).
48
49       -m     Display times in milliseconds. Default: microseconds.
50
51       -P     Summarize by process and not by syscall.
52
53       -l     List the syscalls recognized  by  the  tool  (hard-coded  list).
54              Syscalls beyond this list will still be displayed, as "[unknown:
55              nnn]" where nnn is the syscall number.
56
57       --syscall SYSCALL
58              Trace this syscall only (use option -l  to  get  all  recognized
59              syscalls).
60

EXAMPLES

62       Summarize all syscalls by syscall:
63              # syscount
64
65       Summarize all syscalls by process:
66              # syscount -P
67
68       Summarize only failed syscalls:
69              # syscount -x
70
71       Summarize only syscalls that failed with EPERM:
72              # syscount -e EPERM
73
74       Trace PID 181 only:
75              # syscount -p 181
76
77       Summarize syscalls counts and latencies:
78              # syscount -L
79

FIELDS

81       PID    Process ID
82
83       COMM   Process name
84
85       SYSCALL
86              Syscall  name, or "[unknown: nnn]" for syscalls that aren't rec‐
87              ognized
88
89       COUNT  The number of events
90
91       TIME   The total elapsed time (in us or ms)
92

OVERHEAD

94       For most applications, the overhead should be manageable if  they  per‐
95       form  1000's or even 10,000's of syscalls per second. For higher rates,
96       the overhead may become considerable. For example, tracing a loop of  4
97       million  calls  to  geteuid(), slows it down by 1.85x when tracing only
98       syscall counts, and slows it down by more than 5x when tracing  syscall
99       counts  and  latencies. However, this represents a rate of >3.5 million
100       syscalls per second, which should not be typical.
101

SOURCE

103       This is from bcc.
104
105              https://github.com/iovisor/bcc
106
107       Also look in the bcc distribution for a  companion  _examples.txt  file
108       containing example usage, output, and commentary for this tool.
109

OS

111       Linux
112

STABILITY

114       Unstable - in development.
115

AUTHOR

117       Sasha Goldshtein, Rocky Xing
118