bcc-tools工具之funccount

从funccount的字面意思可以看出，其作用在于统计函数被调用的次数。

废话少说，先看help信息

usage: funccount [-h] [-p PID] [-i INTERVAL] [-d DURATION] [-T] [-r] [-D]
                    pattern

Count functions, tracepoints, and USDT probes

positional arguments:
  pattern               search expression for events

optional arguments:
  -h, --help            show this help message and exit
  -p PID, --pid PID     trace this PID only  #仅仅跟踪某个进程调用情况
  -i INTERVAL, --interval INTERVAL　　　　　　 #每间隔多长时间打印一次跟踪结果
                        summary interval, seconds
  -d DURATION, --duration DURATION           #跟踪持续多长时间，单位为ms
                        total duration of trace, seconds
  -T, --timestamp       include timestamp on output #显示时间戳
  -r, --regexp          use regular expressions. Default is "*" wildcards #对于跟踪某一类的函数，匹配规则可以采用*符号
                        only.
  -D, --debug           print BPF program before starting (for debugging  # 显示跟踪调试信息
                        purposes)

./funccount 'vfs_*'

用于显示vfs_*类函数调用次数

Tracing... Ctrl-C to end.
^C
FUNC                          COUNT
vfs_create                        1
vfs_rename                        1
vfs_fsync_range                   2
vfs_lock_file                    30
vfs_fstatat                     152
vfs_fstat                       154
vfs_write                       166
vfs_getattr_nosec               262

./funccount 'tcp_*'

用于显示tcp类函数调用次数

Tracing... Ctrl-C to end.
^C
FUNC                          COUNT
tcp_try_undo_recovery             1
tcp_twsk_destructor               1
tcp_enter_recovery                1
tcp_xmit_retransmit_queue         1
tcp_update_scoreboard             1
tcp_verify_retransmit_hint        1

./funccount -p 1442 /home/ubuntu/contentions:*

用于跟踪进程1442调用contentions中所有函数的次数

Tracing 15 functions for "/home/ubuntu/contentions:*"... Hit Ctrl-C to end.
^C
FUNC                                           COUNT
main                                               1
_start                                             1
primes_thread                                      2
insert_result                                  87186
is_prime                                     1252772

./funccount -r 'c:(write|read)$'

跟踪用户态动态库write和read的调用情况

用户态函数如果要匹配某类规则的话，需要采用添加字母‘c’, c个人认为表示的是libc。

Tracing 2 functions for "c:(write|read)$"... Hit Ctrl-C to end.
^C
FUNC                                    COUNT
read                                        2
write                                       4

./funccount t:block:*

用于跟踪内核态，block类函数的调用次数，t表示tracepoint

Tracing 19 functions for "t:block:*"... Hit Ctrl-C to end.
^C
FUNC                                    COUNT
block:block_rq_complete                     7
block:block_rq_issue                        7
block:block_getrq                           7
block:block_rq_insert                       7

./funccount u:pthread:*mutex* -p 1442

用于跟踪线程1442中线程调用mutex类相关函数的使用次数

Tracing 7 functions for "u:pthread:*mutex*"... Hit Ctrl-C to end.
^C
FUNC                                    COUNT
mutex_init                                  1
mutex_entry                            547122
mutex_acquired                         547175
mutex_release                          547185

其中u表示用户态。

./funccount -i 1 'vfs_*'

每隔一秒跟踪一次vfs_*类函数

FUNC                          COUNT
vfs_fstatat                       1
vfs_fstat                        16
vfs_getattr_nosec                17
vfs_getattr                      17
vfs_write                        52
vfs_read                         79
vfs_open                         98

FUNC                          COUNT
vfs_fstatat                      10

./funccount -i 1 -d 5 vfs_read 

每隔1s打印一次跟踪结果，持续5s,5s表示的一共打印5次

Tracing 1 functions for "vfs_read"... Hit Ctrl-C to end.

FUNC                                    COUNT
vfs_read                                   30

FUNC                                    COUNT
vfs_read                                   26

FUNC                                    COUNT
vfs_read                                   54

FUNC                                    COUNT
vfs_read                                   25

FUNC                                    COUNT
vfs_read                                   31

但是如果去掉‘-i 1’的话，那就是跟踪时间总共只持续5s

 

user-mode statically defined traces (USDT)