From 610e937e55d19acbcb20db45802042c562e4b2a7 Mon Sep 17 00:00:00 2001 From: Pradyumn Rahar Date: Sat, 9 Nov 2024 14:55:12 +0530 Subject: [PATCH 1/2] Add filters to filetop Signed-off-by: Pradyumn Rahar --- man/man8/filetop.8 | 16 ++++++++++++---- tools/filetop.py | 31 +++++++++++++++++++++++-------- tools/filetop_example.txt | 36 ++++++++++++++++++++++++++++++------ 3 files changed, 65 insertions(+), 18 deletions(-) diff --git a/man/man8/filetop.8 b/man/man8/filetop.8 index 2d5f191db8e6..133242ca3dda 100644 --- a/man/man8/filetop.8 +++ b/man/man8/filetop.8 @@ -2,15 +2,17 @@ .SH NAME filetop \- File reads and writes by filename and process. Top for files. .SH SYNOPSIS -.B filetop [\-h] [\-a] [\-C] [\-r MAXROWS] [\-s {reads,writes,rbytes,wbytes}] [\-p PID] [interval] [count] +.B filetop [\-h] [\-a] [\-C] [\-r MAXROWS] [\-s {reads,writes,rbytes,wbytes}] [\-p PID] [\-\-read-only] [\-\-write-only] [interval] [count] .SH DESCRIPTION This is top for files. This traces file reads and writes, and prints a per-file summary every interval (by default, 1 second). By default the summary is sorted on the highest read -throughput (Kbytes). Sorting order can be changed via -s option. By default only -IO on regular files is shown. The -a option will list all file types (sockets, -FIFOs, etc). +throughput (Kbytes). Sorting order can be changed via -s option. By default +only IO on regular files is shown. The -a option will list all file types +(sockets, FIFOs, etc). Only read or only write operations can be traced using +--read-only or --write-only options respectively. By default both are traced. +Using both options at once will raise an Exception. This uses in-kernel eBPF maps to store per process summaries for efficiency. @@ -46,6 +48,12 @@ Sort column. Default is rbytes (read throughput). \-p PID Trace this PID only. .TP +\-\-read-only +Trace read operations only +.TP +\-\-write-only +Trace write operations only +.TP interval Interval between updates, seconds. .TP diff --git a/tools/filetop.py b/tools/filetop.py index ae3542f233b8..105e4e140866 100755 --- a/tools/filetop.py +++ b/tools/filetop.py @@ -4,7 +4,8 @@ # filetop file reads and writes by process. # For Linux, uses BCC, eBPF. # -# USAGE: filetop.py [-h] [-C] [-r MAXROWS] [interval] [count] +# USAGE: filetop.py [-h] [-a] [-C] [-r MAXROWS] [-p PID] [--read-only] +# [--write-only] [interval] [count] # # This uses in-kernel eBPF maps to store per process summaries for efficiency. # @@ -21,11 +22,13 @@ # arguments examples = """examples: - ./filetop # file I/O top, 1 second refresh - ./filetop -C # don't clear the screen - ./filetop -p 181 # PID 181 only - ./filetop 5 # 5 second summaries - ./filetop 5 10 # 5 second summaries, 10 times only + ./filetop # file I/O top, 1 second refresh + ./filetop -C # don't clear the screen + ./filetop -p 181 # PID 181 only + ./filetop 5 # 5 second summaries + ./filetop 5 10 # 5 second summaries, 10 times only + ./filetop 5 --read-only # 5 second summaries, only read operations traced + ./filetop 5 --write-only # 5 second summaries, only write operations traced """ parser = argparse.ArgumentParser( description="File reads and writes by process", @@ -42,6 +45,10 @@ help="sort column, default all") parser.add_argument("-p", "--pid", type=int, metavar="PID", dest="tgid", help="trace this PID only") +parser.add_argument("--read-only", action="store_true", + help="trace only reads") +parser.add_argument("--write-only", action="store_true", + help="trace only writes") parser.add_argument("interval", nargs="?", default=1, help="output interval, in seconds") parser.add_argument("count", nargs="?", default=99999999, @@ -164,8 +171,16 @@ # initialize BPF b = BPF(text=bpf_text) -b.attach_kprobe(event="vfs_read", fn_name="trace_read_entry") -b.attach_kprobe(event="vfs_write", fn_name="trace_write_entry") +if args.readonly and args.writeonly: + raise Exception("Both read-only and write-only flags passed") +elif args.readonly: + b.attach_kprobe(event="vfs_read", fn_name="trace_read_entry") +elif args.writeonly: + b.attach_kprobe(event="vfs_write", fn_name="trace_write_entry") +else: + b.attach_kprobe(event="vfs_read", fn_name="trace_read_entry") + b.attach_kprobe(event="vfs_write", fn_name="trace_write_entry") + # check whether hash table batch ops is supported htab_batch_ops = True if BPF.kernel_struct_has_field(b'bpf_map_ops', diff --git a/tools/filetop_example.txt b/tools/filetop_example.txt index 66595ad198a4..d15bb4406505 100644 --- a/tools/filetop_example.txt +++ b/tools/filetop_example.txt @@ -130,10 +130,30 @@ socket I/O from an sshd process, showing up as non-regular file types (the "O" for other, and "S" for socket, in the type column: "T"). +# ./filetop 10 --write-only -C +Tracing... Output every 10 secs. Hit Ctrl-C to end + +08:56:49 loadavg: 0.00 0.00 0.00 1/248 775686 + +TID COMM READS WRITES R_Kb W_Kb T FILE +638295 gomon 0 1 0 0 R monitoring.log + +08:56:59 loadavg: 0.00 0.00 0.00 2/246 775686 + +TID COMM READS WRITES R_Kb W_Kb T FILE + +08:57:09 loadavg: 0.00 0.00 0.00 1/246 775686 + +TID COMM READS WRITES R_Kb W_Kb T FILE + +In this example only write operations are traced + + USAGE message: # ./filetop -h -usage: filetop.py [-h] [-a] [-C] [-r MAXROWS] [-p PID] [interval] [count] +usage: filetop.py [-h] [-a] [-C] [-r MAXROWS] [-p PID] [--read-only] [--write-only] + [interval] [count] File reads and writes by process @@ -150,10 +170,14 @@ optional arguments: -s {reads,writes,rbytes,wbytes}, --sort {reads,writes,rbytes,wbytes} sort column, default rbytes -p PID, --pid PID trace this PID only + --read-only trace read operations only + --write-only trace write operations only examples: - ./filetop # file I/O top, 1 second refresh - ./filetop -C # don't clear the screen - ./filetop -p 181 # PID 181 only - ./filetop 5 # 5 second summaries - ./filetop 5 10 # 5 second summaries, 10 times only + ./filetop # file I/O top, 1 second refresh + ./filetop -C # don't clear the screen + ./filetop -p 181 # PID 181 only + ./filetop 5 # 5 second summaries + ./filetop 5 10 # 5 second summaries, 10 times only + ./filetop 5 --read-only # 5 second summaries, only read operations traced + ./filetop 5 --write-only # 5 second summaries, only write operations trace From 63dbaac0a18d51317f4bce269828e2d146cc2cb8 Mon Sep 17 00:00:00 2001 From: Pradyumn Rahar Date: Sat, 9 Nov 2024 15:01:28 +0530 Subject: [PATCH 2/2] Add filters to filetop Signed-off-by: Pradyumn Rahar --- tools/filetop.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/filetop.py b/tools/filetop.py index 105e4e140866..fda917ca9ea0 100755 --- a/tools/filetop.py +++ b/tools/filetop.py @@ -171,11 +171,11 @@ # initialize BPF b = BPF(text=bpf_text) -if args.readonly and args.writeonly: +if args.read_only and args.write_only: raise Exception("Both read-only and write-only flags passed") -elif args.readonly: +elif args.read_only: b.attach_kprobe(event="vfs_read", fn_name="trace_read_entry") -elif args.writeonly: +elif args.write_only: b.attach_kprobe(event="vfs_write", fn_name="trace_write_entry") else: b.attach_kprobe(event="vfs_read", fn_name="trace_read_entry")