1Demonstrations of dcsnoop, the Linux eBPF/bcc version. 2 3 4dcsnoop traces directory entry cache (dcache) lookups, and can be used for 5further investigation beyond dcstat(8). The output is likely verbose, as 6dcache lookups are likely frequent. By default, only failed lookups are shown. 7For example: 8 9# ./dcsnoop.py 10TIME(s) PID COMM T FILE 110.002837 1643 snmpd M net/dev 120.002852 1643 snmpd M 1643 130.002856 1643 snmpd M net 140.002863 1643 snmpd M dev 150.002952 1643 snmpd M net/if_inet6 160.002964 1643 snmpd M if_inet6 170.003180 1643 snmpd M net/ipv4/neigh/eth0/retrans_time_ms 180.003192 1643 snmpd M ipv4/neigh/eth0/retrans_time_ms 190.003197 1643 snmpd M neigh/eth0/retrans_time_ms 200.003203 1643 snmpd M eth0/retrans_time_ms 210.003206 1643 snmpd M retrans_time_ms 220.003245 1643 snmpd M ipv6/neigh/eth0/retrans_time_ms 230.003249 1643 snmpd M neigh/eth0/retrans_time_ms 240.003252 1643 snmpd M eth0/retrans_time_ms 250.003255 1643 snmpd M retrans_time_ms 260.003287 1643 snmpd M conf/eth0/forwarding 270.003292 1643 snmpd M eth0/forwarding 280.003295 1643 snmpd M forwarding 290.003326 1643 snmpd M base_reachable_time_ms 30[...] 31 32I ran a drop caches at the same time as executing this tool. The output shows 33the processes, the type of event ("T" column: M == miss, R == reference), 34and the filename for the dcache lookup. 35 36The way the dcache is currently implemented, each component of a path is 37checked in turn. The first line, showing "net/dev" from snmp, will be a lookup 38for "net" in a directory (that isn't shown here). If it finds "net", it will 39then lookup "dev" inside net. You can see this sequence a little later, 40starting at time 0.003180, where a pathname is being searched 41directory by directory. 42 43 44The -a option will show all lookups, although be warned, the output will be 45very verbose. For example: 46 47# ./dcsnoop 48TIME(s) PID COMM T FILE 490.000000 20279 dcsnoop.py M p_lookup_fast 500.000010 20279 dcsnoop.py M enable 510.000013 20279 dcsnoop.py M id 520.000015 20279 dcsnoop.py M filter 530.000017 20279 dcsnoop.py M trigger 540.000019 20279 dcsnoop.py M format 550.006148 20279 dcsnoop.py R sys/kernel/debug/tracing/trace_pipe 560.006158 20279 dcsnoop.py R kernel/debug/tracing/trace_pipe 570.006161 20279 dcsnoop.py R debug/tracing/trace_pipe 580.006164 20279 dcsnoop.py R tracing/trace_pipe 590.006166 20279 dcsnoop.py R trace_pipe 600.015900 1643 snmpd R proc/sys/net/ipv6/conf/lo/forwarding 610.015901 1643 snmpd R sys/net/ipv6/conf/lo/forwarding 620.015901 1643 snmpd R net/ipv6/conf/lo/forwarding 630.015902 1643 snmpd R ipv6/conf/lo/forwarding 640.015903 1643 snmpd R conf/lo/forwarding 650.015904 1643 snmpd R lo/forwarding 660.015905 1643 snmpd M lo/forwarding 670.015908 1643 snmpd R forwarding 680.015909 1643 snmpd M forwarding 690.015937 1643 snmpd R proc/sys/net/ipv6/neigh/lo/base_reachable_time_ms 700.015937 1643 snmpd R sys/net/ipv6/neigh/lo/base_reachable_time_ms 710.015938 1643 snmpd R net/ipv6/neigh/lo/base_reachable_time_ms 720.015939 1643 snmpd R ipv6/neigh/lo/base_reachable_time_ms 730.015940 1643 snmpd R neigh/lo/base_reachable_time_ms 740.015941 1643 snmpd R lo/base_reachable_time_ms 750.015941 1643 snmpd R base_reachable_time_ms 760.015943 1643 snmpd M base_reachable_time_ms 770.043569 1876 supervise M 20281 780.043573 1886 supervise M 20280 790.043582 1886 supervise R supervise/status.new 80[...] 81 82 83USAGE message: 84 85# ./dcsnoop.py -h 86usage: dcsnoop.py [-h] [-a] 87 88Trace directory entry cache (dcache) lookups 89 90optional arguments: 91 -h, --help show this help message and exit 92 -a, --all trace all lookups (default is fails only) 93 94examples: 95 ./dcsnoop # trace failed dcache lookups 96 ./dcsnoop -a # trace all dcache lookups 97