aDriv4 - MANAGER

Edit File: dcsnoop_example.txt

Demonstrations of dcsnoop, the Linux bpftrace/eBPF version. dcsnoop traces directory entry cache (dcache) lookups, and can be used for further investigation beyond dcstat(8). The output is likely verbose, as dcache lookups are likely frequent. For example: # ./dcsnoop.bt Attaching 4 probes... Tracing dcache lookups... Hit Ctrl-C to end. TIME PID COMM T FILE 427 1518 irqbalance R proc/interrupts 427 1518 irqbalance R interrupts 427 1518 irqbalance R proc/stat 427 1518 irqbalance R stat 483 2440 snmp-pass R proc/cpuinfo 483 2440 snmp-pass R cpuinfo 486 2440 snmp-pass R proc/stat 486 2440 snmp-pass R stat 834 1744 snmpd R proc/net/dev 834 1744 snmpd R net/dev 834 1744 snmpd R self/net 834 1744 snmpd R 1744 834 1744 snmpd R net 834 1744 snmpd R dev 834 1744 snmpd R proc/net/if_inet6 834 1744 snmpd R net/if_inet6 834 1744 snmpd R self/net 834 1744 snmpd R 1744 834 1744 snmpd R net 834 1744 snmpd R if_inet6 835 1744 snmpd R sys/class/net/docker0/device/vendor 835 1744 snmpd R class/net/docker0/device/vendor 835 1744 snmpd R net/docker0/device/vendor 835 1744 snmpd R docker0/device/vendor 835 1744 snmpd R devices/virtual/net/docker0 835 1744 snmpd R virtual/net/docker0 835 1744 snmpd R net/docker0 835 1744 snmpd R docker0 835 1744 snmpd R device/vendor 835 1744 snmpd R proc/sys/net/ipv4/neigh/docker0/retrans_time_ms 835 1744 snmpd R sys/net/ipv4/neigh/docker0/retrans_time_ms 835 1744 snmpd R net/ipv4/neigh/docker0/retrans_time_ms 835 1744 snmpd R ipv4/neigh/docker0/retrans_time_ms 835 1744 snmpd R neigh/docker0/retrans_time_ms 835 1744 snmpd R docker0/retrans_time_ms 835 1744 snmpd R retrans_time_ms 835 1744 snmpd R proc/sys/net/ipv6/neigh/docker0/retrans_time_ms 835 1744 snmpd R sys/net/ipv6/neigh/docker0/retrans_time_ms 835 1744 snmpd R net/ipv6/neigh/docker0/retrans_time_ms 835 1744 snmpd R ipv6/neigh/docker0/retrans_time_ms 835 1744 snmpd R neigh/docker0/retrans_time_ms 835 1744 snmpd R docker0/retrans_time_ms 835 1744 snmpd R retrans_time_ms 835 1744 snmpd R proc/sys/net/ipv6/conf/docker0/forwarding 835 1744 snmpd R sys/net/ipv6/conf/docker0/forwarding 835 1744 snmpd R net/ipv6/conf/docker0/forwarding 835 1744 snmpd R ipv6/conf/docker0/forwarding 835 1744 snmpd R conf/docker0/forwarding [...] 5154 934 cksum R usr/bin/basename 5154 934 cksum R bin/basename 5154 934 cksum R basename 5154 934 cksum R usr/bin/bashbug 5154 934 cksum R bin/bashbug 5154 934 cksum R bashbug 5154 934 cksum M bashbug 5155 934 cksum R usr/bin/batch 5155 934 cksum R bin/batch 5155 934 cksum R batch 5155 934 cksum M batch 5155 934 cksum R usr/bin/bc 5155 934 cksum R bin/bc 5155 934 cksum R bc 5155 934 cksum M bc 5169 934 cksum R usr/bin/bdftopcf 5169 934 cksum R bin/bdftopcf 5169 934 cksum R bdftopcf 5169 934 cksum M bdftopcf 5173 934 cksum R usr/bin/bdftruncate 5173 934 cksum R bin/bdftruncate 5173 934 cksum R bdftruncate 5173 934 cksum M bdftruncate The way the dcache is currently implemented, each component of a path is checked in turn. The first line, showing "proc/interrupts" from irqbalance, will be a lookup for "proc" in a directory (that isn't shown here). If it finds "proc", it will then lookup "interrupts" inside net. The script is easily modifiable to only show misses, reducing the volume of the output. Or use the bcc version of this tool, which only shows misses by default: https://github.com/iovisor/bcc