bpftrace/tools/pidpersec.bt at master · sevan/bpftrace · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
#!/usr/bin/env bpftrace
// pidpersec	Count new processes (via fork).
// 		For Linux, uses bpftrace and eBPF.
//
// Written as a basic example of counting on an event.
//
// Example of usage:
//
// # ./pidpersec.bt
// Attaching 4 probes...
// Tracing new processes... Hit Ctrl-C to end.
// 22:29:50 PIDs/sec: @: 121
// 22:29:51 PIDs/sec: @: 120
// 22:29:52 PIDs/sec: @: 122
// 22:29:53 PIDs/sec: @: 124
// ^C
//
// The output begins by showing a rate of new processes over 120 per second.
//
//
// The following example shows a Linux build launched at 6:33:40, on a 36 CPU
// server, with make -j36:
//
// # ./pidpersec.bt
// Attaching 4 probes...
// Tracing new processes... Hit Ctrl-C to end.
// 06:33:38 PIDs/sec:
// 06:33:39 PIDs/sec:
// 06:33:40 PIDs/sec: @: 2314
// 06:33:41 PIDs/sec: @: 2517
// 06:33:42 PIDs/sec: @: 1345
// 06:33:43 PIDs/sec: @: 1752
//
// A Linux kernel build involves launched many thousands of short-lived processes,
// which can be seen in the above output: a rate of over 1,000 processes per
// second.
//
// This is a bpftrace version of the bcc tool of the same name.
//
// Copyright 2018 Netflix, Inc.
//
// 06-Sep-2018	Brendan Gregg	Created this.

BEGIN
{
  printf("Tracing new processes... Hit Ctrl-C to end.\n");
}

tracepoint:sched:sched_process_fork
{
  @ = count();
}

interval:1s
{
  time("%H:%M:%S PIDs/sec: ");
  print(@);
  clear(@);
}

END
{
  clear(@);
}