Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add filters to filetop #5003

Merged
merged 2 commits into from
Nov 14, 2024
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
Add filters to filetop
Signed-off-by: Pradyumn Rahar <[email protected]>
  • Loading branch information
Hannibal404 committed Nov 9, 2024
commit 610e937e55d19acbcb20db45802042c562e4b2a7
16 changes: 12 additions & 4 deletions man/man8/filetop.8
Original file line number Diff line number Diff line change
@@ -2,15 +2,17 @@
.SH NAME
filetop \- File reads and writes by filename and process. Top for files.
.SH SYNOPSIS
.B filetop [\-h] [\-a] [\-C] [\-r MAXROWS] [\-s {reads,writes,rbytes,wbytes}] [\-p PID] [interval] [count]
.B filetop [\-h] [\-a] [\-C] [\-r MAXROWS] [\-s {reads,writes,rbytes,wbytes}] [\-p PID] [\-\-read-only] [\-\-write-only] [interval] [count]
.SH DESCRIPTION
This is top for files.

This traces file reads and writes, and prints a per-file summary every interval
(by default, 1 second). By default the summary is sorted on the highest read
throughput (Kbytes). Sorting order can be changed via -s option. By default only
IO on regular files is shown. The -a option will list all file types (sockets,
FIFOs, etc).
throughput (Kbytes). Sorting order can be changed via -s option. By default
only IO on regular files is shown. The -a option will list all file types
(sockets, FIFOs, etc). Only read or only write operations can be traced using
--read-only or --write-only options respectively. By default both are traced.
Using both options at once will raise an Exception.

This uses in-kernel eBPF maps to store per process summaries for efficiency.

@@ -46,6 +48,12 @@ Sort column. Default is rbytes (read throughput).
\-p PID
Trace this PID only.
.TP
\-\-read-only
Trace read operations only
.TP
\-\-write-only
Trace write operations only
.TP
interval
Interval between updates, seconds.
.TP
31 changes: 23 additions & 8 deletions tools/filetop.py
Original file line number Diff line number Diff line change
@@ -4,7 +4,8 @@
# filetop file reads and writes by process.
# For Linux, uses BCC, eBPF.
#
# USAGE: filetop.py [-h] [-C] [-r MAXROWS] [interval] [count]
# USAGE: filetop.py [-h] [-a] [-C] [-r MAXROWS] [-p PID] [--read-only]
# [--write-only] [interval] [count]
#
# This uses in-kernel eBPF maps to store per process summaries for efficiency.
#
@@ -21,11 +22,13 @@

# arguments
examples = """examples:
./filetop # file I/O top, 1 second refresh
./filetop -C # don't clear the screen
./filetop -p 181 # PID 181 only
./filetop 5 # 5 second summaries
./filetop 5 10 # 5 second summaries, 10 times only
./filetop # file I/O top, 1 second refresh
./filetop -C # don't clear the screen
./filetop -p 181 # PID 181 only
./filetop 5 # 5 second summaries
./filetop 5 10 # 5 second summaries, 10 times only
./filetop 5 --read-only # 5 second summaries, only read operations traced
./filetop 5 --write-only # 5 second summaries, only write operations traced
"""
parser = argparse.ArgumentParser(
description="File reads and writes by process",
@@ -42,6 +45,10 @@
help="sort column, default all")
parser.add_argument("-p", "--pid", type=int, metavar="PID", dest="tgid",
help="trace this PID only")
parser.add_argument("--read-only", action="store_true",
help="trace only reads")
parser.add_argument("--write-only", action="store_true",
help="trace only writes")
parser.add_argument("interval", nargs="?", default=1,
help="output interval, in seconds")
parser.add_argument("count", nargs="?", default=99999999,
@@ -164,8 +171,16 @@

# initialize BPF
b = BPF(text=bpf_text)
b.attach_kprobe(event="vfs_read", fn_name="trace_read_entry")
b.attach_kprobe(event="vfs_write", fn_name="trace_write_entry")
if args.readonly and args.writeonly:
raise Exception("Both read-only and write-only flags passed")
elif args.readonly:
b.attach_kprobe(event="vfs_read", fn_name="trace_read_entry")
elif args.writeonly:
b.attach_kprobe(event="vfs_write", fn_name="trace_write_entry")
else:
b.attach_kprobe(event="vfs_read", fn_name="trace_read_entry")
b.attach_kprobe(event="vfs_write", fn_name="trace_write_entry")


# check whether hash table batch ops is supported
htab_batch_ops = True if BPF.kernel_struct_has_field(b'bpf_map_ops',
36 changes: 30 additions & 6 deletions tools/filetop_example.txt
Original file line number Diff line number Diff line change
@@ -130,10 +130,30 @@ socket I/O from an sshd process, showing up as non-regular file types (the "O"
for other, and "S" for socket, in the type column: "T").


# ./filetop 10 --write-only -C
Tracing... Output every 10 secs. Hit Ctrl-C to end

08:56:49 loadavg: 0.00 0.00 0.00 1/248 775686

TID COMM READS WRITES R_Kb W_Kb T FILE
638295 gomon 0 1 0 0 R monitoring.log

08:56:59 loadavg: 0.00 0.00 0.00 2/246 775686

TID COMM READS WRITES R_Kb W_Kb T FILE

08:57:09 loadavg: 0.00 0.00 0.00 1/246 775686

TID COMM READS WRITES R_Kb W_Kb T FILE

In this example only write operations are traced


USAGE message:

# ./filetop -h
usage: filetop.py [-h] [-a] [-C] [-r MAXROWS] [-p PID] [interval] [count]
usage: filetop.py [-h] [-a] [-C] [-r MAXROWS] [-p PID] [--read-only] [--write-only]
[interval] [count]

File reads and writes by process

@@ -150,10 +170,14 @@ optional arguments:
-s {reads,writes,rbytes,wbytes}, --sort {reads,writes,rbytes,wbytes}
sort column, default rbytes
-p PID, --pid PID trace this PID only
--read-only trace read operations only
--write-only trace write operations only

examples:
./filetop # file I/O top, 1 second refresh
./filetop -C # don't clear the screen
./filetop -p 181 # PID 181 only
./filetop 5 # 5 second summaries
./filetop 5 10 # 5 second summaries, 10 times only
./filetop # file I/O top, 1 second refresh
./filetop -C # don't clear the screen
./filetop -p 181 # PID 181 only
./filetop 5 # 5 second summaries
./filetop 5 10 # 5 second summaries, 10 times only
./filetop 5 --read-only # 5 second summaries, only read operations traced
./filetop 5 --write-only # 5 second summaries, only write operations trace