BPF
===
###### tags: `bpf`
ref: https://github.com/brendangregg/bpf-perf-tools-book
本篇紀錄閱讀 bpf-perf-tools-book 心得

## BCC & bpftrace
ref:
https://github.com/iovisor/bcc
https://github.com/iovisor/bpftrace

[簡介](https://hackmd.io/@sysprog/linux-ebpf)
BPF 分為兩大主軸: BCC & Bpftrace
BCC 建立 BPF 環境使檢測系統效能變得更容易，並提供 c++, python, lua 當作前端
bpftrace 為一種高階追蹤語言，透過 BCC 使用 linux kernel BPF 系統

linux BPF system 使用以下追蹤工具
- kernel dynamic tracing(kprobes)
- user-level dynamic tracing (uprobes)
- tracepoints
- USDT
- Dynamic USDT

可以監控系統 performance, latency, behavior

## How to trace interpreted languages or applications
ref: https://docs.python.org/3/howto/instrumentation.html
Use USDT, Dtrace and SystemTap to trace programming and applications.

### Show dynamic library

$ ldd /bin/python3.8
    linux-vdso.so.1 (0x00007ffe53f16000)
	libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007ff24908f000)
	libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007ff24906c000)
	libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007ff249066000)
	libutil.so.1 => /lib/x86_64-linux-gnu/libutil.so.1 (0x00007ff249061000)
	libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007ff248f12000)
	libexpat.so.1 => /lib/x86_64-linux-gnu/libexpat.so.1 (0x00007ff248ee4000)
	libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007ff248ec6000)
	/lib64/ld-linux-x86-64.so.2 (0x00007ff24929d000)

## Chap8 File Systems
針對檔案系統，列出一些功能

### 8.1.2 BPF Capabilities
#### Overhead
- Over 100k events per second on Logical I/O.
- check the I/O rate before hand with iostat(1)

#### Strategy
- There is a overall strategy we can follow.

### 8.3.1 opensnoop
`sudo opensnoop.bt`
trace program opened.

### 8.3.2 statsnoop

`statsnoop`
trace file statistics.

### 8.3.8 vfsstat
summarize statistics for some common VFS calls: read, write(I/O), creates, opens, and fsyncs.

### 8.3.9 vfscount
print a frequency count of their calls
`funccount 'vfs_*'`
`bpftrace -e 'kprobe:vfs_* { @[func] = count(); }'`

### 8.3.13 filetop
most frequently read or written filenames.

### 8.3.14 writesync
traces VFS writes to regular files and shows which were using a synchronous write flag.

### 8.3.16 cachestat
shows page cache hit and miss statistics.

### 8.3.17 writeback
shows the operation of page cache write-back