1#!/usr/bin/python 2# Copyright (c) PLUMgrid, Inc. 3# Licensed under the Apache License, Version 2.0 (the "License") 4 5# This is an example of tracing an event and printing custom fields. 6# run in project examples directory with: 7# sudo ./trace_fields.py" 8 9import atexit 10from bcc import BPF 11from bcc.utils import printb 12import ctypes as ct 13 14class Data(ct.Structure): 15 _fields_ = [("ts", ct.c_ulonglong), 16 ("magic", ct.c_ulonglong)] 17 18counter = 0 19def cb(cpu, data, size): 20 assert size >= ct.sizeof(Data) 21 event = ct.cast(data, ct.POINTER(Data)).contents 22 print("[%0d] %f: %x" % (cpu, float(event.ts) / 1000000, event.magic)) 23 global counter 24 counter += 1 25 26prog = """ 27BPF_PERF_OUTPUT(events); 28BPF_ARRAY(counters, u64, 10); 29int do_sys_clone(void *ctx) { 30 struct { 31 u64 ts; 32 u64 magic; 33 } data = {bpf_ktime_get_ns(), 0x12345678}; 34 int rc; 35 if ((rc = events.perf_submit(ctx, &data, sizeof(data))) < 0) 36 bpf_trace_printk("perf_output failed: %d\\n", rc); 37 int zero = 0; 38 u64 *val = counters.lookup(&zero); 39 if (val) lock_xadd(val, 1); 40 return 0; 41} 42""" 43b = BPF(text=prog) 44event_name = b.get_syscall_fnname("clone") 45b.attach_kprobe(event=event_name, fn_name="do_sys_clone") 46b["events"].open_perf_buffer(cb) 47 48@atexit.register 49def print_counter(): 50 global counter 51 global b 52 print("counter = %d vs %d" % (counter, b["counters"][ct.c_int(0)].value)) 53 54printb(b"Tracing " + event_name + b", try `dd if=/dev/zero of=/dev/null`") 55print("Tracing... Hit Ctrl-C to end.") 56while 1: 57 try: 58 b.perf_buffer_poll() 59 except KeyboardInterrupt: 60 exit() 61