系统级跟踪 eBPF 工具 —— bpftrace 入门
· ☕ 1 分钟
bpftrace 简介
bpftrace 简单使用
查询可以跟踪的内核函数,以 sleep 为关键字
|
|
跟踪所有 sys_enter_open() 系统调用
|
|
然后在另外一个终端中
|
|
可以看到在 bpftrace 终端中输出:
|
|
|
|
然后在另外一个终端中
|
|
可以看到在 bpftrace 终端中输出:
From [Understanding The Linux Kernel]
之前我们了解到,Linux 倾向用最多的内存做 Page Cache。这使我们不得不考虑如何在内存不足前回收内存。问题是,回收内存的程序本身也可能有 IO 操作,也可能需要内存。
page cache 中的每个 page 均归属于文件. 这个文件 — 或更精确来说,是文件的 inode 被称为 page 的owner
.
Page cahce 的核心数据结构是 addrees_space
。一般来说,每个 inode
(Kernel 用来存放文件元信息的内存中的数据结构,可以视为一个文件的描述信息)中包含一个 addrees_space
。
肯尼斯·汤普森(Kenneth Thompson)与丹尼斯·里奇(Dennis Ritchie)一起在AT&T贝尔实验室开发了UNIX。 UNIX操作系统结合了Multics提供的许多分时和文件管理功能,并由此得名。 (Multics是1960年代中期的一个项目,代表了创建多用户,多任务操作系统的第一项努力。)UNIX操作系统迅速赢得了广泛的关注,尤其是在工程师和科学家中。
翻开印象笔记,我回顾了一下最有价值的资料:
Docker/Container 实现原理和架构的入门
https://tenzir.com/blog/production-debugging-bpftrace-uprobes/
https://shaharmike.com/cpp/vtable-part1/
|
|
$ # compile our code with debug symbols and start debugging using gdb
$ clang++ -std=c++14 -stdlib=libc++ -g main.cpp && gdb ./a.out
...
(gdb) # ask gdb to automatically demangle C++ symbols
(gdb) set print asm-demangle on
(gdb) set print demangle on
(gdb) # set breakpoint at main
(gdb) b main
Breakpoint 1 at 0x4009ac: file main.cpp, line 15.
(gdb) run
Starting program: /home/shmike/cpp/a.out
Breakpoint 1, main () at main.cpp:15
15 Parent p1, p2;
(gdb) # skip to next line
(gdb) n
16 Derived d1, d2;
(gdb) # skip to next line
(gdb) n
18 std::cout << "done" << std::endl;
(gdb) # print p1, p2, d1, d2 - we'll talk about what the output means soon
(gdb) p p1
$1 = {_vptr$Parent = 0x400bb8 <vtable for Parent+16>}
(gdb) p p2
$2 = {_vptr$Parent = 0x400bb8 <vtable for Parent+16>}
(gdb) p d1
$3 = {<Parent> = {_vptr$Parent = 0x400b50 <vtable for Derived+16>}, <No data fields>}
(gdb) p d2
$4 = {<Parent> = {_vptr$Parent = 0x400b50 <vtable for Derived+16>}, <No data fields>}
Here’s what we learned from the above:
Cluster: a logical service with a set of endpoints that Envoy forwards requests to.
Downstream: an entity connecting to Envoy. This may be a local application (in a sidecar model) or a network node. In non-sidecar models, this is a remote client.
Endpoints: network nodes that implement a logical service. They are grouped into clusters. Endpoints in a cluster are upstream
of an Envoy proxy.
Filter: a module in the connection or request processing pipeline providing some aspect of request handling. An analogy from Unix is the composition of small utilities (filters) with Unix pipes (filter chains).