61 lines
1.6 KiB
Groff
61 lines
1.6 KiB
Groff
.TH threadsnoop 8 "2019-07-02" "USER COMMANDS"
|
|
.SH NAME
|
|
threadsnoop \- Trace thread creation via pthread_create(). Uses BCC/eBPF.
|
|
.SH SYNOPSIS
|
|
.B threadsnoop
|
|
.SH DESCRIPTION
|
|
threadsnoop traces calls to pthread_create(), showing this path of thread
|
|
creation. This can be used for workload characterization and discovery, and is
|
|
a companion to execsnoop(8) which traces execve(2).
|
|
|
|
This works by tracing the pthread_create() from libpthread.so.0. The path
|
|
to this library may need adjusting in the tool source to match your system.
|
|
|
|
Since this uses BPF, only the root user can use this tool.
|
|
.SH REQUIREMENTS
|
|
CONFIG_BPF and BCC.
|
|
.SH EXAMPLES
|
|
.TP
|
|
Trace calls pthread_create():
|
|
#
|
|
.B threadsnoop
|
|
.SH FIELDS
|
|
.TP
|
|
TIME(ms)
|
|
Elapsed time since the tool began tracing (in milliseconds).
|
|
.TP
|
|
PID
|
|
The process ID.
|
|
.TP
|
|
COMM
|
|
The process (thread) name.
|
|
.TP
|
|
FUNC
|
|
The name of the start routine, if the symbol is available, else a hex address
|
|
for the start routine address.
|
|
.SH OVERHEAD
|
|
Thread creation is expected to be low (<< 1000/s), so the overhead of this
|
|
tool is expected to be negligible.
|
|
.SH SOURCE
|
|
This originated as a bpftrace tool from the book "BPF Performance Tools",
|
|
published by Addison Wesley (2019):
|
|
.IP
|
|
http://www.brendangregg.com/bpf-performance-tools-book.html
|
|
.PP
|
|
See the book for more documentation on this tool.
|
|
.PP
|
|
This version is in the BCC repository:
|
|
.IP
|
|
https://github.com/iovisor/bcc
|
|
.PP
|
|
Also look in the bcc distribution for a companion _examples.txt file
|
|
containing example usage, output, and commentary for this tool.
|
|
.SH OS
|
|
Linux
|
|
.SH STABILITY
|
|
Unstable - in development.
|
|
.SH AUTHOR
|
|
Brendan Gregg
|
|
.SH SEE ALSO
|
|
execsnoop(8)
|