Current Dir: /usr/sbin/
[FILE] a2disconf [ edit | delete | rename ]
[FILE] a2dismod [ edit | delete | rename ]
[FILE] a2dissite [ edit | delete | rename ]
[FILE] a2enconf [ edit | delete | rename ]
[FILE] a2enmod [ edit | delete | rename ]
[FILE] a2ensite [ edit | delete | rename ]
[FILE] a2query [ edit | delete | rename ]
[FILE] aa-load [ edit | delete | rename ]
[FILE] aa-remove-unknown [ edit | delete | rename ]
[FILE] aa-status [ edit | delete | rename ]
[FILE] aa-teardown [ edit | delete | rename ]
[FILE] accessdb [ edit | delete | rename ]
[FILE] add-shell [ edit | delete | rename ]
[FILE] addgnupghome [ edit | delete | rename ]
[FILE] addgroup [ edit | delete | rename ]
[FILE] adduser [ edit | delete | rename ]
[FILE] agetty [ edit | delete | rename ]
[FILE] apache2 [ edit | delete | rename ]
[FILE] apache2ctl [ edit | delete | rename ]
[FILE] apachectl [ edit | delete | rename ]
[FILE] apparmor_parser [ edit | delete | rename ]
[FILE] apparmor_status [ edit | delete | rename ]
[FILE] applygnupgdefaults [ edit | delete | rename ]
[FILE] argdist-bpfcc [ edit | delete | rename ]
[FILE] arpd [ edit | delete | rename ]
[FILE] arptables [ edit | delete | rename ]
[FILE] arptables-nft [ edit | delete | rename ]
[FILE] arptables-nft-restore [ edit | delete | rename ]
[FILE] arptables-nft-save [ edit | delete | rename ]
[FILE] arptables-restore [ edit | delete | rename ]
[FILE] arptables-save [ edit | delete | rename ]
[FILE] badblocks [ edit | delete | rename ]
[FILE] bashreadline-bpfcc [ edit | delete | rename ]
[FILE] bashreadline.bt [ edit | delete | rename ]
[FILE] bcache-super-show [ edit | delete | rename ]
[FILE] bindsnoop-bpfcc [ edit | delete | rename ]
[FILE] biolatency-bpfcc [ edit | delete | rename ]
[FILE] biolatency-kp.bt [ edit | delete | rename ]
[FILE] biolatency.bt [ edit | delete | rename ]
[FILE] biolatpcts-bpfcc [ edit | delete | rename ]
[FILE] biopattern-bpfcc [ edit | delete | rename ]
[FILE] biosdecode [ edit | delete | rename ]
[FILE] biosnoop-bpfcc [ edit | delete | rename ]
[FILE] biosnoop.bt [ edit | delete | rename ]
[FILE] biostacks.bt [ edit | delete | rename ]
[FILE] biotop-bpfcc [ edit | delete | rename ]
[FILE] bitesize-bpfcc [ edit | delete | rename ]
[FILE] bitesize.bt [ edit | delete | rename ]
[FILE] blkdeactivate [ edit | delete | rename ]
[FILE] blkdiscard [ edit | delete | rename ]
[FILE] blkid [ edit | delete | rename ]
[FILE] blkzone [ edit | delete | rename ]
[FILE] blockdev [ edit | delete | rename ]
[FILE] bpflist-bpfcc [ edit | delete | rename ]
[FILE] bpftool [ edit | delete | rename ]
[FILE] bridge [ edit | delete | rename ]
[FILE] btrfsdist-bpfcc [ edit | delete | rename ]
[FILE] btrfsslower-bpfcc [ edit | delete | rename ]
[FILE] cachestat-bpfcc [ edit | delete | rename ]
[FILE] cachetop-bpfcc [ edit | delete | rename ]
[FILE] cache_check [ edit | delete | rename ]
[FILE] cache_dump [ edit | delete | rename ]
[FILE] cache_metadata_size [ edit | delete | rename ]
[FILE] cache_repair [ edit | delete | rename ]
[FILE] cache_restore [ edit | delete | rename ]
[FILE] cache_writeback [ edit | delete | rename ]
[FILE] capable-bpfcc [ edit | delete | rename ]
[FILE] capable.bt [ edit | delete | rename ]
[FILE] capsh [ edit | delete | rename ]
[FILE] cfdisk [ edit | delete | rename ]
[FILE] cgdisk [ edit | delete | rename ]
[FILE] chcpu [ edit | delete | rename ]
[FILE] check_forensic [ edit | delete | rename ]
[FILE] chgpasswd [ edit | delete | rename ]
[FILE] chmem [ edit | delete | rename ]
[FILE] chpasswd [ edit | delete | rename ]
[FILE] chroot [ edit | delete | rename ]
[FILE] cobjnew-bpfcc [ edit | delete | rename ]
[FILE] compactsnoop-bpfcc [ edit | delete | rename ]
[FILE] cpgr [ edit | delete | rename ]
[FILE] cppw [ edit | delete | rename ]
[FILE] cpudist-bpfcc [ edit | delete | rename ]
[FILE] cpuunclaimed-bpfcc [ edit | delete | rename ]
[FILE] cpuwalk.bt [ edit | delete | rename ]
[FILE] criticalstat-bpfcc [ edit | delete | rename ]
[FILE] cron [ edit | delete | rename ]
[FILE] cryptdisks_start [ edit | delete | rename ]
[FILE] cryptdisks_stop [ edit | delete | rename ]
[FILE] cryptsetup [ edit | delete | rename ]
[FILE] ctrlaltdel [ edit | delete | rename ]
[FILE] dbslower-bpfcc [ edit | delete | rename ]
[FILE] dbstat-bpfcc [ edit | delete | rename ]
[FILE] dcb [ edit | delete | rename ]
[FILE] dcsnoop-bpfcc [ edit | delete | rename ]
[FILE] dcsnoop.bt [ edit | delete | rename ]
[FILE] dcstat-bpfcc [ edit | delete | rename ]
[FILE] deadlock-bpfcc [ edit | delete | rename ]
[FILE] debugfs [ edit | delete | rename ]
[FILE] delgroup [ edit | delete | rename ]
[FILE] deluser [ edit | delete | rename ]
[FILE] depmod [ edit | delete | rename ]
[FILE] devlink [ edit | delete | rename ]
[FILE] dhcpcd [ edit | delete | rename ]
[FILE] dirtop-bpfcc [ edit | delete | rename ]
[FILE] dmeventd [ edit | delete | rename ]
[FILE] dmidecode [ edit | delete | rename ]
[FILE] dmsetup [ edit | delete | rename ]
[FILE] dmstats [ edit | delete | rename ]
[FILE] dosfsck [ edit | delete | rename ]
[FILE] dosfslabel [ edit | delete | rename ]
[FILE] dpkg-preconfigure [ edit | delete | rename ]
[FILE] dpkg-reconfigure [ edit | delete | rename ]
[FILE] drsnoop-bpfcc [ edit | delete | rename ]
[FILE] dumpe2fs [ edit | delete | rename ]
[FILE] e2freefrag [ edit | delete | rename ]
[FILE] e2fsck [ edit | delete | rename ]
[FILE] e2image [ edit | delete | rename ]
[FILE] e2label [ edit | delete | rename ]
[FILE] e2mmpstatus [ edit | delete | rename ]
[FILE] e2scrub [ edit | delete | rename ]
[FILE] e2scrub_all [ edit | delete | rename ]
[FILE] e2undo [ edit | delete | rename ]
[FILE] e4crypt [ edit | delete | rename ]
[FILE] e4defrag [ edit | delete | rename ]
[FILE] ebtables [ edit | delete | rename ]
[FILE] ebtables-nft [ edit | delete | rename ]
[FILE] ebtables-nft-restore [ edit | delete | rename ]
[FILE] ebtables-nft-save [ edit | delete | rename ]
[FILE] ebtables-restore [ edit | delete | rename ]
[FILE] ebtables-save [ edit | delete | rename ]
[FILE] ebtables-translate [ edit | delete | rename ]
[FILE] era_check [ edit | delete | rename ]
[FILE] era_dump [ edit | delete | rename ]
[FILE] era_invalidate [ edit | delete | rename ]
[FILE] era_restore [ edit | delete | rename ]
[FILE] escapesrc [ edit | delete | rename ]
[FILE] ethtool [ edit | delete | rename ]
[FILE] execsnoop-bpfcc [ edit | delete | rename ]
[FILE] execsnoop.bt [ edit | delete | rename ]
[FILE] exitsnoop-bpfcc [ edit | delete | rename ]
[FILE] ext4dist-bpfcc [ edit | delete | rename ]
[FILE] ext4slower-bpfcc [ edit | delete | rename ]
[FILE] faillock [ edit | delete | rename ]
[FILE] fatlabel [ edit | delete | rename ]
[FILE] fdisk [ edit | delete | rename ]
[FILE] filefrag [ edit | delete | rename ]
[FILE] filegone-bpfcc [ edit | delete | rename ]
[FILE] filelife-bpfcc [ edit | delete | rename ]
[FILE] fileslower-bpfcc [ edit | delete | rename ]
[FILE] filetop-bpfcc [ edit | delete | rename ]
[FILE] findfs [ edit | delete | rename ]
[FILE] fixparts [ edit | delete | rename ]
[FILE] fsadm [ edit | delete | rename ]
[FILE] fsck [ edit | delete | rename ]
[FILE] fsck.btrfs [ edit | delete | rename ]
[FILE] fsck.cramfs [ edit | delete | rename ]
[FILE] fsck.ext2 [ edit | delete | rename ]
[FILE] fsck.ext3 [ edit | delete | rename ]
[FILE] fsck.ext4 [ edit | delete | rename ]
[FILE] fsck.fat [ edit | delete | rename ]
[FILE] fsck.minix [ edit | delete | rename ]
[FILE] fsck.msdos [ edit | delete | rename ]
[FILE] fsck.vfat [ edit | delete | rename ]
[FILE] fsck.xfs [ edit | delete | rename ]
[FILE] fsfreeze [ edit | delete | rename ]
[FILE] fstab-decode [ edit | delete | rename ]
[FILE] fstrim [ edit | delete | rename ]
[FILE] funccount-bpfcc [ edit | delete | rename ]
[FILE] funcinterval-bpfcc [ edit | delete | rename ]
[FILE] funclatency-bpfcc [ edit | delete | rename ]
[FILE] funcslower-bpfcc [ edit | delete | rename ]
[FILE] gdisk [ edit | delete | rename ]
[FILE] genccode [ edit | delete | rename ]
[FILE] gencmn [ edit | delete | rename ]
[FILE] genl [ edit | delete | rename ]
[FILE] gennorm2 [ edit | delete | rename ]
[FILE] gensprep [ edit | delete | rename ]
[FILE] getcap [ edit | delete | rename ]
[FILE] gethostlatency-bpfcc [ edit | delete | rename ]
[FILE] gethostlatency.bt [ edit | delete | rename ]
[FILE] getpcaps [ edit | delete | rename ]
[FILE] getty [ edit | delete | rename ]
[FILE] groupadd [ edit | delete | rename ]
[FILE] groupdel [ edit | delete | rename ]
[FILE] groupmems [ edit | delete | rename ]
[FILE] groupmod [ edit | delete | rename ]
[FILE] grpck [ edit | delete | rename ]
[FILE] grpconv [ edit | delete | rename ]
[FILE] grpunconv [ edit | delete | rename ]
[FILE] grub-bios-setup [ edit | delete | rename ]
[FILE] grub-install [ edit | delete | rename ]
[FILE] grub-macbless [ edit | delete | rename ]
[FILE] grub-mkconfig [ edit | delete | rename ]
[FILE] grub-mkdevicemap [ edit | delete | rename ]
[FILE] grub-probe [ edit | delete | rename ]
[FILE] grub-reboot [ edit | delete | rename ]
[FILE] grub-set-default [ edit | delete | rename ]
[FILE] halt [ edit | delete | rename ]
[FILE] hardirqs-bpfcc [ edit | delete | rename ]
[FILE] hdparm [ edit | delete | rename ]
[FILE] httxt2dbm [ edit | delete | rename ]
[FILE] iconvconfig [ edit | delete | rename ]
[FILE] icupkg [ edit | delete | rename ]
[FILE] init [ edit | delete | rename ]
[FILE] inject-bpfcc [ edit | delete | rename ]
[FILE] insmod [ edit | delete | rename ]
[FILE] install-sgmlcatalog [ edit | delete | rename ]
[FILE] installkernel [ edit | delete | rename ]
[FILE] integritysetup [ edit | delete | rename ]
[FILE] invoke-rc.d [ edit | delete | rename ]
[FILE] ip [ edit | delete | rename ]
[FILE] ip6tables [ edit | delete | rename ]
[FILE] ip6tables-apply [ edit | delete | rename ]
[FILE] ip6tables-legacy [ edit | delete | rename ]
[FILE] ip6tables-legacy-restore [ edit | delete | rename ]
[FILE] ip6tables-legacy-save [ edit | delete | rename ]
[FILE] ip6tables-nft [ edit | delete | rename ]
[FILE] ip6tables-nft-restore [ edit | delete | rename ]
[FILE] ip6tables-nft-save [ edit | delete | rename ]
[FILE] ip6tables-restore [ edit | delete | rename ]
[FILE] ip6tables-restore-translate [ edit | delete | rename ]
[FILE] ip6tables-save [ edit | delete | rename ]
[FILE] ip6tables-translate [ edit | delete | rename ]
[FILE] iptables [ edit | delete | rename ]
[FILE] iptables-apply [ edit | delete | rename ]
[FILE] iptables-legacy [ edit | delete | rename ]
[FILE] iptables-legacy-restore [ edit | delete | rename ]
[FILE] iptables-legacy-save [ edit | delete | rename ]
[FILE] iptables-nft [ edit | delete | rename ]
[FILE] iptables-nft-restore [ edit | delete | rename ]
[FILE] iptables-nft-save [ edit | delete | rename ]
[FILE] iptables-restore [ edit | delete | rename ]
[FILE] iptables-restore-translate [ edit | delete | rename ]
[FILE] iptables-save [ edit | delete | rename ]
[FILE] iptables-translate [ edit | delete | rename ]
[FILE] iscsi-iname [ edit | delete | rename ]
[FILE] iscsiadm [ edit | delete | rename ]
[FILE] iscsid [ edit | delete | rename ]
[FILE] iscsistart [ edit | delete | rename ]
[FILE] iscsi_discovery [ edit | delete | rename ]
[FILE] isosize [ edit | delete | rename ]
[FILE] javacalls-bpfcc [ edit | delete | rename ]
[FILE] javaflow-bpfcc [ edit | delete | rename ]
[FILE] javagc-bpfcc [ edit | delete | rename ]
[FILE] javaobjnew-bpfcc [ edit | delete | rename ]
[FILE] javastat-bpfcc [ edit | delete | rename ]
[FILE] javathreads-bpfcc [ edit | delete | rename ]
[FILE] kbdrate [ edit | delete | rename ]
[FILE] killall5 [ edit | delete | rename ]
[FILE] killsnoop-bpfcc [ edit | delete | rename ]
[FILE] killsnoop.bt [ edit | delete | rename ]
[FILE] klockstat-bpfcc [ edit | delete | rename ]
[FILE] kpartx [ edit | delete | rename ]
[FILE] kvmexit-bpfcc [ edit | delete | rename ]
[FILE] ldattach [ edit | delete | rename ]
[FILE] ldconfig [ edit | delete | rename ]
[FILE] ldconfig.real [ edit | delete | rename ]
[FILE] llcstat-bpfcc [ edit | delete | rename ]
[FILE] loads.bt [ edit | delete | rename ]
[FILE] locale-gen [ edit | delete | rename ]
[FILE] logrotate [ edit | delete | rename ]
[FILE] logsave [ edit | delete | rename ]
[FILE] losetup [ edit | delete | rename ]
[FILE] lsmod [ edit | delete | rename ]
[FILE] luksformat [ edit | delete | rename ]
[FILE] lvchange [ edit | delete | rename ]
[FILE] lvconvert [ edit | delete | rename ]
[FILE] lvcreate [ edit | delete | rename ]
[FILE] lvdisplay [ edit | delete | rename ]
[FILE] lvextend [ edit | delete | rename ]
[FILE] lvm [ edit | delete | rename ]
[FILE] lvmconfig [ edit | delete | rename ]
[FILE] lvmdiskscan [ edit | delete | rename ]
[FILE] lvmdump [ edit | delete | rename ]
[FILE] lvmpolld [ edit | delete | rename ]
[FILE] lvmsadc [ edit | delete | rename ]
[FILE] lvmsar [ edit | delete | rename ]
[FILE] lvreduce [ edit | delete | rename ]
[FILE] lvremove [ edit | delete | rename ]
[FILE] lvrename [ edit | delete | rename ]
[FILE] lvresize [ edit | delete | rename ]
[FILE] lvs [ edit | delete | rename ]
[FILE] lvscan [ edit | delete | rename ]
[FILE] lxc [ edit | delete | rename ]
[FILE] lxd [ edit | delete | rename ]
[FILE] make-bcache [ edit | delete | rename ]
[FILE] make-ssl-cert [ edit | delete | rename ]
[FILE] mdadm [ edit | delete | rename ]
[FILE] mdflush-bpfcc [ edit | delete | rename ]
[FILE] mdflush.bt [ edit | delete | rename ]
[FILE] mdmon [ edit | delete | rename ]
[FILE] memleak-bpfcc [ edit | delete | rename ]
[FILE] mkdosfs [ edit | delete | rename ]
[FILE] mke2fs [ edit | delete | rename ]
[FILE] mkfs [ edit | delete | rename ]
[FILE] mkfs.bfs [ edit | delete | rename ]
[FILE] mkfs.btrfs [ edit | delete | rename ]
[FILE] mkfs.cramfs [ edit | delete | rename ]
[FILE] mkfs.ext2 [ edit | delete | rename ]
[FILE] mkfs.ext3 [ edit | delete | rename ]
[FILE] mkfs.ext4 [ edit | delete | rename ]
[FILE] mkfs.fat [ edit | delete | rename ]
[FILE] mkfs.minix [ edit | delete | rename ]
[FILE] mkfs.msdos [ edit | delete | rename ]
[FILE] mkfs.ntfs [ edit | delete | rename ]
[FILE] mkfs.vfat [ edit | delete | rename ]
[FILE] mkfs.xfs [ edit | delete | rename ]
[FILE] mkhomedir_helper [ edit | delete | rename ]
[FILE] mkinitramfs [ edit | delete | rename ]
[FILE] mklost+found [ edit | delete | rename ]
[FILE] mkntfs [ edit | delete | rename ]
[FILE] mkswap [ edit | delete | rename ]
[FILE] ModemManager [ edit | delete | rename ]
[FILE] modinfo [ edit | delete | rename ]
[FILE] modprobe [ edit | delete | rename ]
[FILE] mount.fuse [ edit | delete | rename ]
[FILE] mount.fuse3 [ edit | delete | rename ]
[FILE] mount.lowntfs-3g [ edit | delete | rename ]
[FILE] mount.ntfs [ edit | delete | rename ]
[FILE] mount.ntfs-3g [ edit | delete | rename ]
[FILE] mountsnoop-bpfcc [ edit | delete | rename ]
[FILE] mpathpersist [ edit | delete | rename ]
[FILE] multipath [ edit | delete | rename ]
[FILE] multipathc [ edit | delete | rename ]
[FILE] multipathd [ edit | delete | rename ]
[FILE] mysqld [ edit | delete | rename ]
[FILE] mysqld_qslower-bpfcc [ edit | delete | rename ]
[FILE] naptime.bt [ edit | delete | rename ]
[FILE] needrestart [ edit | delete | rename ]
[FILE] netplan [ edit | delete | rename ]
[FILE] netqtop-bpfcc [ edit | delete | rename ]
[FILE] newusers [ edit | delete | rename ]
[FILE] nfnl_osf [ edit | delete | rename ]
[FILE] nfsdist-bpfcc [ edit | delete | rename ]
[FILE] nfsslower-bpfcc [ edit | delete | rename ]
[FILE] nft [ edit | delete | rename ]
[FILE] nginx [ edit | delete | rename ]
[FILE] nodegc-bpfcc [ edit | delete | rename ]
[FILE] nodestat-bpfcc [ edit | delete | rename ]
[FILE] nologin [ edit | delete | rename ]
[FILE] ntfsclone [ edit | delete | rename ]
[FILE] ntfscp [ edit | delete | rename ]
[FILE] ntfslabel [ edit | delete | rename ]
[FILE] ntfsresize [ edit | delete | rename ]
[FILE] ntfsundelete [ edit | delete | rename ]
[FILE] offcputime-bpfcc [ edit | delete | rename ]
[FILE] offwaketime-bpfcc [ edit | delete | rename ]
[FILE] on_ac_power [ edit | delete | rename ]
[FILE] oomkill-bpfcc [ edit | delete | rename ]
[FILE] oomkill.bt [ edit | delete | rename ]
[FILE] opendkim [ edit | delete | rename ]
[FILE] opendkim-atpszone [ edit | delete | rename ]
[FILE] opendkim-expire [ edit | delete | rename ]
[FILE] opendkim-gengraphs [ edit | delete | rename ]
[FILE] opendkim-genkey [ edit | delete | rename ]
[FILE] opendkim-genstats [ edit | delete | rename ]
[FILE] opendkim-genzone [ edit | delete | rename ]
[FILE] opendkim-importstats [ edit | delete | rename ]
[FILE] opendkim-stats [ edit | delete | rename ]
[FILE] opendkim-testkey [ edit | delete | rename ]
[FILE] opendkim-testmsg [ edit | delete | rename ]
[FILE] opensnoop-bpfcc [ edit | delete | rename ]
[FILE] opensnoop.bt [ edit | delete | rename ]
[FILE] overlayroot-chroot [ edit | delete | rename ]
[FILE] ownership [ edit | delete | rename ]
[FILE] pam-auth-update [ edit | delete | rename ]
[FILE] pam_extrausers_chkpwd [ edit | delete | rename ]
[FILE] pam_extrausers_update [ edit | delete | rename ]
[FILE] pam_getenv [ edit | delete | rename ]
[FILE] pam_namespace_helper [ edit | delete | rename ]
[FILE] pam_timestamp_check [ edit | delete | rename ]
[FILE] paperconfig [ edit | delete | rename ]
[FILE] parted [ edit | delete | rename ]
[FILE] partprobe [ edit | delete | rename ]
[FILE] pdata_tools [ edit | delete | rename ]
[FILE] perlcalls-bpfcc [ edit | delete | rename ]
[FILE] perlflow-bpfcc [ edit | delete | rename ]
[FILE] perlstat-bpfcc [ edit | delete | rename ]
[FILE] pg_updatedicts [ edit | delete | rename ]
[FILE] phpcalls-bpfcc [ edit | delete | rename ]
[FILE] phpdismod [ edit | delete | rename ]
[FILE] phpenmod [ edit | delete | rename ]
[FILE] phpflow-bpfcc [ edit | delete | rename ]
[FILE] phpquery [ edit | delete | rename ]
[FILE] phpstat-bpfcc [ edit | delete | rename ]
[FILE] pidpersec-bpfcc [ edit | delete | rename ]
[FILE] pidpersec.bt [ edit | delete | rename ]
[FILE] pivot_root [ edit | delete | rename ]
[FILE] plocate-build [ edit | delete | rename ]
[FILE] plymouthd [ edit | delete | rename ]
[FILE] postalias [ edit | delete | rename ]
[FILE] postcat [ edit | delete | rename ]
[FILE] postconf [ edit | delete | rename ]
[FILE] postdrop [ edit | delete | rename ]
[FILE] postfix [ edit | delete | rename ]
[FILE] postfix-add-filter [ edit | delete | rename ]
[FILE] postfix-add-policy [ edit | delete | rename ]
[FILE] postfix-collate [ edit | delete | rename ]
[FILE] postkick [ edit | delete | rename ]
[FILE] postlock [ edit | delete | rename ]
[FILE] postlog [ edit | delete | rename ]
[FILE] postmap [ edit | delete | rename ]
[FILE] postmulti [ edit | delete | rename ]
[FILE] postqueue [ edit | delete | rename ]
[FILE] postsuper [ edit | delete | rename ]
[FILE] posttls-finger [ edit | delete | rename ]
[FILE] poweroff [ edit | delete | rename ]
[FILE] ppchcalls-bpfcc [ edit | delete | rename ]
[FILE] profile-bpfcc [ edit | delete | rename ]
[FILE] pvchange [ edit | delete | rename ]
[FILE] pvck [ edit | delete | rename ]
[FILE] pvcreate [ edit | delete | rename ]
[FILE] pvdisplay [ edit | delete | rename ]
[FILE] pvmove [ edit | delete | rename ]
[FILE] pvremove [ edit | delete | rename ]
[FILE] pvresize [ edit | delete | rename ]
[FILE] pvs [ edit | delete | rename ]
[FILE] pvscan [ edit | delete | rename ]
[FILE] pwck [ edit | delete | rename ]
[FILE] pwconv [ edit | delete | rename ]
[FILE] pwhistory_helper [ edit | delete | rename ]
[FILE] pwunconv [ edit | delete | rename ]
[FILE] pythoncalls-bpfcc [ edit | delete | rename ]
[FILE] pythonflow-bpfcc [ edit | delete | rename ]
[FILE] pythongc-bpfcc [ edit | delete | rename ]
[FILE] pythonstat-bpfcc [ edit | delete | rename ]
[FILE] qemu-ga [ edit | delete | rename ]
[FILE] qmqp-sink [ edit | delete | rename ]
[FILE] qmqp-source [ edit | delete | rename ]
[FILE] qshape [ edit | delete | rename ]
[FILE] rdmaucma-bpfcc [ edit | delete | rename ]
[FILE] readahead-bpfcc [ edit | delete | rename ]
[FILE] readprofile [ edit | delete | rename ]
[FILE] reboot [ edit | delete | rename ]
[FILE] remove-shell [ edit | delete | rename ]
[FILE] reset-trace-bpfcc [ edit | delete | rename ]
[FILE] resize2fs [ edit | delete | rename ]
[FILE] resolvconf [ edit | delete | rename ]
[FILE] rmail [ edit | delete | rename ]
[FILE] rmmod [ edit | delete | rename ]
[FILE] rmt [ edit | delete | rename ]
[FILE] rmt-tar [ edit | delete | rename ]
[FILE] rsyslogd [ edit | delete | rename ]
[FILE] rtacct [ edit | delete | rename ]
[FILE] rtcwake [ edit | delete | rename ]
[FILE] rtmon [ edit | delete | rename ]
[FILE] rubycalls-bpfcc [ edit | delete | rename ]
[FILE] rubyflow-bpfcc [ edit | delete | rename ]
[FILE] rubygc-bpfcc [ edit | delete | rename ]
[FILE] rubyobjnew-bpfcc [ edit | delete | rename ]
[FILE] rubystat-bpfcc [ edit | delete | rename ]
[FILE] runlevel [ edit | delete | rename ]
[FILE] runqlat-bpfcc [ edit | delete | rename ]
[FILE] runqlat.bt [ edit | delete | rename ]
[FILE] runqlen-bpfcc [ edit | delete | rename ]
[FILE] runqlen.bt [ edit | delete | rename ]
[FILE] runqslower-bpfcc [ edit | delete | rename ]
[FILE] runuser [ edit | delete | rename ]
[FILE] sendmail [ edit | delete | rename ]
[FILE] service [ edit | delete | rename ]
[FILE] setcap [ edit | delete | rename ]
[FILE] setuids.bt [ edit | delete | rename ]
[FILE] setvesablank [ edit | delete | rename ]
[FILE] setvtrgb [ edit | delete | rename ]
[FILE] sfdisk [ edit | delete | rename ]
[FILE] sgdisk [ edit | delete | rename ]
[FILE] shadowconfig [ edit | delete | rename ]
[FILE] shmsnoop-bpfcc [ edit | delete | rename ]
[FILE] shutdown [ edit | delete | rename ]
[FILE] slabratetop-bpfcc [ edit | delete | rename ]
[FILE] smtp-sink [ edit | delete | rename ]
[FILE] smtp-source [ edit | delete | rename ]
[FILE] sofdsnoop-bpfcc [ edit | delete | rename ]
[FILE] softirqs-bpfcc [ edit | delete | rename ]
[FILE] solisten-bpfcc [ edit | delete | rename ]
[FILE] split-logfile [ edit | delete | rename ]
[FILE] sshd [ edit | delete | rename ]
[FILE] ssllatency.bt [ edit | delete | rename ]
[FILE] sslsniff-bpfcc [ edit | delete | rename ]
[FILE] sslsnoop.bt [ edit | delete | rename ]
[FILE] stackcount-bpfcc [ edit | delete | rename ]
[FILE] start-stop-daemon [ edit | delete | rename ]
[FILE] statsnoop-bpfcc [ edit | delete | rename ]
[FILE] statsnoop.bt [ edit | delete | rename ]
[FILE] sudo_logsrvd [ edit | delete | rename ]
[FILE] sudo_sendlog [ edit | delete | rename ]
[FILE] sulogin [ edit | delete | rename ]
[FILE] swapin.bt [ edit | delete | rename ]
[FILE] swaplabel [ edit | delete | rename ]
[FILE] swapoff [ edit | delete | rename ]
[FILE] swapon [ edit | delete | rename ]
[FILE] switch_root [ edit | delete | rename ]
[FILE] syncsnoop-bpfcc [ edit | delete | rename ]
[FILE] syncsnoop.bt [ edit | delete | rename ]
[FILE] syscount-bpfcc [ edit | delete | rename ]
[FILE] syscount.bt [ edit | delete | rename ]
[FILE] sysctl [ edit | delete | rename ]
[FILE] tarcat [ edit | delete | rename ]
[FILE] tc [ edit | delete | rename ]
[FILE] tclcalls-bpfcc [ edit | delete | rename ]
[FILE] tclflow-bpfcc [ edit | delete | rename ]
[FILE] tclobjnew-bpfcc [ edit | delete | rename ]
[FILE] tclstat-bpfcc [ edit | delete | rename ]
[FILE] tcpaccept-bpfcc [ edit | delete | rename ]
[FILE] tcpaccept.bt [ edit | delete | rename ]
[FILE] tcpcong-bpfcc [ edit | delete | rename ]
[FILE] tcpconnect-bpfcc [ edit | delete | rename ]
[FILE] tcpconnect.bt [ edit | delete | rename ]
[FILE] tcpconnlat-bpfcc [ edit | delete | rename ]
[FILE] tcpdrop-bpfcc [ edit | delete | rename ]
[FILE] tcpdrop.bt [ edit | delete | rename ]
[FILE] tcplife-bpfcc [ edit | delete | rename ]
[FILE] tcplife.bt [ edit | delete | rename ]
[FILE] tcpretrans-bpfcc [ edit | delete | rename ]
[FILE] tcpretrans.bt [ edit | delete | rename ]
[FILE] tcprtt-bpfcc [ edit | delete | rename ]
[FILE] tcpstates-bpfcc [ edit | delete | rename ]
[FILE] tcpsubnet-bpfcc [ edit | delete | rename ]
[FILE] tcpsynbl-bpfcc [ edit | delete | rename ]
[FILE] tcpsynbl.bt [ edit | delete | rename ]
[FILE] tcptop-bpfcc [ edit | delete | rename ]
[FILE] tcptracer-bpfcc [ edit | delete | rename ]
[FILE] telinit [ edit | delete | rename ]
[FILE] thin_check [ edit | delete | rename ]
[FILE] thin_delta [ edit | delete | rename ]
[FILE] thin_dump [ edit | delete | rename ]
[FILE] thin_ls [ edit | delete | rename ]
[FILE] thin_metadata_size [ edit | delete | rename ]
[FILE] thin_repair [ edit | delete | rename ]
[FILE] thin_restore [ edit | delete | rename ]
[FILE] thin_rmap [ edit | delete | rename ]
[FILE] thin_trim [ edit | delete | rename ]
[FILE] threadsnoop-bpfcc [ edit | delete | rename ]
[FILE] threadsnoop.bt [ edit | delete | rename ]
[FILE] tipc [ edit | delete | rename ]
[FILE] tplist-bpfcc [ edit | delete | rename ]
[FILE] trace-bpfcc [ edit | delete | rename ]
[FILE] ttysnoop-bpfcc [ edit | delete | rename ]
[FILE] tune2fs [ edit | delete | rename ]
[FILE] ucalls [ edit | delete | rename ]
[FILE] uflow [ edit | delete | rename ]
[FILE] ufw [ edit | delete | rename ]
[FILE] ugc [ edit | delete | rename ]
[FILE] umount.udisks2 [ edit | delete | rename ]
[FILE] undump.bt [ edit | delete | rename ]
[FILE] unix_chkpwd [ edit | delete | rename ]
[FILE] unix_update [ edit | delete | rename ]
[FILE] uobjnew [ edit | delete | rename ]
[FILE] update-ca-certificates [ edit | delete | rename ]
[FILE] update-catalog [ edit | delete | rename ]
[FILE] update-fonts-alias [ edit | delete | rename ]
[FILE] update-fonts-dir [ edit | delete | rename ]
[FILE] update-fonts-scale [ edit | delete | rename ]
[FILE] update-grub [ edit | delete | rename ]
[FILE] update-grub-gfxpayload [ edit | delete | rename ]
[FILE] update-grub2 [ edit | delete | rename ]
[FILE] update-gsfontmap [ edit | delete | rename ]
[FILE] update-icon-caches [ edit | delete | rename ]
[FILE] update-ieee-data [ edit | delete | rename ]
[FILE] update-info-dir [ edit | delete | rename ]
[FILE] update-initramfs [ edit | delete | rename ]
[FILE] update-locale [ edit | delete | rename ]
[FILE] update-mime [ edit | delete | rename ]
[FILE] update-passwd [ edit | delete | rename ]
[FILE] update-pciids [ edit | delete | rename ]
[FILE] update-rc.d [ edit | delete | rename ]
[FILE] update-secureboot-policy [ edit | delete | rename ]
[FILE] update-shells [ edit | delete | rename ]
[FILE] update-xmlcatalog [ edit | delete | rename ]
[FILE] updatedb.plocate [ edit | delete | rename ]
[FILE] upgrade-from-grub-legacy [ edit | delete | rename ]
[FILE] usb_modeswitch [ edit | delete | rename ]
[FILE] usb_modeswitch_dispatcher [ edit | delete | rename ]
[FILE] useradd [ edit | delete | rename ]
[FILE] userdel [ edit | delete | rename ]
[FILE] usermod [ edit | delete | rename ]
[FILE] ustat [ edit | delete | rename ]
[FILE] uthreads [ edit | delete | rename ]
[FILE] uuidd [ edit | delete | rename ]
[FILE] validlocale [ edit | delete | rename ]
[FILE] vcstime [ edit | delete | rename ]
[FILE] vdpa [ edit | delete | rename ]
[FILE] veritysetup [ edit | delete | rename ]
[FILE] vfscount-bpfcc [ edit | delete | rename ]
[FILE] vfscount.bt [ edit | delete | rename ]
[FILE] vfsstat-bpfcc [ edit | delete | rename ]
[FILE] vfsstat.bt [ edit | delete | rename ]
[FILE] vgcfgbackup [ edit | delete | rename ]
[FILE] vgcfgrestore [ edit | delete | rename ]
[FILE] vgchange [ edit | delete | rename ]
[FILE] vgck [ edit | delete | rename ]
[FILE] vgconvert [ edit | delete | rename ]
[FILE] vgcreate [ edit | delete | rename ]
[FILE] vgdisplay [ edit | delete | rename ]
[FILE] vgexport [ edit | delete | rename ]
[FILE] vgextend [ edit | delete | rename ]
[FILE] vgimport [ edit | delete | rename ]
[FILE] vgimportclone [ edit | delete | rename ]
[FILE] vgmerge [ edit | delete | rename ]
[FILE] vgmknodes [ edit | delete | rename ]
[FILE] vgreduce [ edit | delete | rename ]
[FILE] vgremove [ edit | delete | rename ]
[FILE] vgrename [ edit | delete | rename ]
[FILE] vgs [ edit | delete | rename ]
[FILE] vgscan [ edit | delete | rename ]
[FILE] vgsplit [ edit | delete | rename ]
[FILE] vigr [ edit | delete | rename ]
[FILE] vipw [ edit | delete | rename ]
[FILE] virtiostat-bpfcc [ edit | delete | rename ]
[FILE] visudo [ edit | delete | rename ]
[FILE] vpddecode [ edit | delete | rename ]
[FILE] wakeuptime-bpfcc [ edit | delete | rename ]
[FILE] wipefs [ edit | delete | rename ]
[FILE] writeback.bt [ edit | delete | rename ]
[FILE] xfsdist-bpfcc [ edit | delete | rename ]
[FILE] xfsdist.bt [ edit | delete | rename ]
[FILE] xfsslower-bpfcc [ edit | delete | rename ]
[FILE] xfs_admin [ edit | delete | rename ]
[FILE] xfs_bmap [ edit | delete | rename ]
[FILE] xfs_copy [ edit | delete | rename ]
[FILE] xfs_db [ edit | delete | rename ]
[FILE] xfs_estimate [ edit | delete | rename ]
[FILE] xfs_freeze [ edit | delete | rename ]
[FILE] xfs_fsr [ edit | delete | rename ]
[FILE] xfs_growfs [ edit | delete | rename ]
[FILE] xfs_info [ edit | delete | rename ]
[FILE] xfs_io [ edit | delete | rename ]
[FILE] xfs_logprint [ edit | delete | rename ]
[FILE] xfs_mdrestore [ edit | delete | rename ]
[FILE] xfs_metadump [ edit | delete | rename ]
[FILE] xfs_mkfile [ edit | delete | rename ]
[FILE] xfs_ncheck [ edit | delete | rename ]
[FILE] xfs_quota [ edit | delete | rename ]
[FILE] xfs_repair [ edit | delete | rename ]
[FILE] xfs_rtcp [ edit | delete | rename ]
[FILE] xfs_scrub [ edit | delete | rename ]
[FILE] xfs_scrub_all [ edit | delete | rename ]
[FILE] xfs_spaceman [ edit | delete | rename ]
[FILE] xtables-legacy-multi [ edit | delete | rename ]
[FILE] xtables-monitor [ edit | delete | rename ]
[FILE] xtables-nft-multi [ edit | delete | rename ]
[FILE] zerofree [ edit | delete | rename ]
[FILE] zfsdist-bpfcc [ edit | delete | rename ]
[FILE] zfsslower-bpfcc [ edit | delete | rename ]
[FILE] zic [ edit | delete | rename ]
[FILE] zramctl [ edit | delete | rename ]
Viewing: /usr/sbin/memleak-bpfcc
#! /usr/bin/python3
#
# memleak Trace and display outstanding allocations to detect
# memory leaks in user-mode processes and the kernel.
#
# USAGE: memleak [-h] [-p PID] [-t] [-a] [-o OLDER] [-c COMMAND]
# [--combined-only] [--wa-missing-free] [-s SAMPLE_RATE]
# [-T TOP] [-z MIN_SIZE] [-Z MAX_SIZE] [-O OBJ]
# [interval] [count]
#
# Licensed under the Apache License, Version 2.0 (the "License")
# Copyright (C) 2016 Sasha Goldshtein.
from bcc import BPF
from time import sleep
from datetime import datetime
import resource
import argparse
import subprocess
import os
import sys
class Allocation(object):
def __init__(self, stack, size):
self.stack = stack
self.count = 1
self.size = size
def update(self, size):
self.count += 1
self.size += size
def run_command_get_output(command):
p = subprocess.Popen(command.split(),
stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
return iter(p.stdout.readline, b'')
def run_command_get_pid(command):
p = subprocess.Popen(command.split())
return p.pid
sort_keys = ["size", "count"]
alloc_sort_map = {sort_keys[0]: lambda a: a.size,
sort_keys[1]: lambda a: a.count};
combined_sort_map = {sort_keys[0]: lambda a: -a[1].total_size,
sort_keys[1]: lambda a: -a[1].number_of_allocs};
examples = """
EXAMPLES:
./memleak -p $(pidof allocs)
Trace allocations and display a summary of "leaked" (outstanding)
allocations every 5 seconds
./memleak -p $(pidof allocs) -t
Trace allocations and display each individual allocator function call
./memleak -ap $(pidof allocs) 10
Trace allocations and display allocated addresses, sizes, and stacks
every 10 seconds for outstanding allocations
./memleak -c "./allocs"
Run the specified command and trace its allocations
./memleak
Trace allocations in kernel mode and display a summary of outstanding
allocations every 5 seconds
./memleak -o 60000
Trace allocations in kernel mode and display a summary of outstanding
allocations that are at least one minute (60 seconds) old
./memleak -s 5
Trace roughly every 5th allocation, to reduce overhead
./memleak --sort count
Trace allocations in kernel mode and display a summary of outstanding
allocations that are sorted in count order
"""
description = """
Trace outstanding memory allocations that weren't freed.
Supports both user-mode allocations made with libc functions and kernel-mode
allocations made with kmalloc/kmem_cache_alloc/get_free_pages and corresponding
memory release functions.
"""
parser = argparse.ArgumentParser(description=description,
formatter_class=argparse.RawDescriptionHelpFormatter,
epilog=examples)
parser.add_argument("-p", "--pid", type=int, default=-1,
help="the PID to trace; if not specified, trace kernel allocs")
parser.add_argument("-t", "--trace", action="store_true",
help="print trace messages for each alloc/free call")
parser.add_argument("interval", nargs="?", default=5, type=int,
help="interval in seconds to print outstanding allocations")
parser.add_argument("count", nargs="?", type=int,
help="number of times to print the report before exiting")
parser.add_argument("-a", "--show-allocs", default=False, action="store_true",
help="show allocation addresses and sizes as well as call stacks")
parser.add_argument("-o", "--older", default=500, type=int,
help="prune allocations younger than this age in milliseconds")
parser.add_argument("-c", "--command",
help="execute and trace the specified command")
parser.add_argument("--combined-only", default=False, action="store_true",
help="show combined allocation statistics only")
parser.add_argument("--wa-missing-free", default=False, action="store_true",
help="Workaround to alleviate misjudgments when free is missing")
parser.add_argument("-s", "--sample-rate", default=1, type=int,
help="sample every N-th allocation to decrease the overhead")
parser.add_argument("-T", "--top", type=int, default=10,
help="display only this many top allocating stacks (by size)")
parser.add_argument("-z", "--min-size", type=int,
help="capture only allocations larger than this size")
parser.add_argument("-Z", "--max-size", type=int,
help="capture only allocations smaller than this size")
parser.add_argument("-O", "--obj", type=str, default="c",
help="attach to allocator functions in the specified object")
parser.add_argument("--ebpf", action="store_true",
help=argparse.SUPPRESS)
parser.add_argument("--percpu", default=False, action="store_true",
help="trace percpu allocations")
parser.add_argument("--sort", type=str, default="size",
help="report sorted in given key; available key list: size, count")
parser.add_argument("--symbols-prefix", type=str,
help="memory alloctor symbols prefix")
args = parser.parse_args()
pid = args.pid
command = args.command
kernel_trace = (pid == -1 and command is None)
trace_all = args.trace
interval = args.interval
min_age_ns = 1e6 * args.older
sample_every_n = args.sample_rate
num_prints = args.count
top_stacks = args.top
min_size = args.min_size
max_size = args.max_size
obj = args.obj
sort_key = args.sort
if sort_key not in sort_keys:
print("Given sort_key:", sort_key)
print("Supporting sort key list:", sort_keys)
exit(1)
if min_size is not None and max_size is not None and min_size > max_size:
print("min_size (-z) can't be greater than max_size (-Z)")
exit(1)
if command is not None:
print("Executing '%s' and tracing the resulting process." % command)
pid = run_command_get_pid(command)
bpf_source = """
#include <uapi/linux/ptrace.h>
struct alloc_info_t {
u64 size;
u64 timestamp_ns;
int stack_id;
};
struct combined_alloc_info_t {
u64 total_size;
u64 number_of_allocs;
};
BPF_HASH(sizes, u64);
BPF_HASH(allocs, u64, struct alloc_info_t, 1000000);
BPF_HASH(memptrs, u64, u64);
BPF_STACK_TRACE(stack_traces, 10240);
BPF_HASH(combined_allocs, u64, struct combined_alloc_info_t, 10240);
static inline void update_statistics_add(u64 stack_id, u64 sz) {
struct combined_alloc_info_t *existing_cinfo;
struct combined_alloc_info_t cinfo = {0};
existing_cinfo = combined_allocs.lookup(&stack_id);
if (existing_cinfo != 0)
cinfo = *existing_cinfo;
cinfo.total_size += sz;
cinfo.number_of_allocs += 1;
combined_allocs.update(&stack_id, &cinfo);
}
static inline void update_statistics_del(u64 stack_id, u64 sz) {
struct combined_alloc_info_t *existing_cinfo;
struct combined_alloc_info_t cinfo = {0};
existing_cinfo = combined_allocs.lookup(&stack_id);
if (existing_cinfo != 0)
cinfo = *existing_cinfo;
if (sz >= cinfo.total_size)
cinfo.total_size = 0;
else
cinfo.total_size -= sz;
if (cinfo.number_of_allocs > 0)
cinfo.number_of_allocs -= 1;
combined_allocs.update(&stack_id, &cinfo);
}
static inline int gen_alloc_enter(struct pt_regs *ctx, size_t size) {
SIZE_FILTER
if (SAMPLE_EVERY_N > 1) {
u64 ts = bpf_ktime_get_ns();
if (ts % SAMPLE_EVERY_N != 0)
return 0;
}
u64 pid = bpf_get_current_pid_tgid();
u64 size64 = size;
sizes.update(&pid, &size64);
if (SHOULD_PRINT)
bpf_trace_printk("alloc entered, size = %u\\n", size);
return 0;
}
static inline int gen_alloc_exit2(struct pt_regs *ctx, u64 address) {
u64 pid = bpf_get_current_pid_tgid();
u64* size64 = sizes.lookup(&pid);
struct alloc_info_t info = {0};
if (size64 == 0)
return 0; // missed alloc entry
info.size = *size64;
sizes.delete(&pid);
if (address != 0) {
info.timestamp_ns = bpf_ktime_get_ns();
info.stack_id = stack_traces.get_stackid(ctx, STACK_FLAGS);
allocs.update(&address, &info);
update_statistics_add(info.stack_id, info.size);
}
if (SHOULD_PRINT) {
bpf_trace_printk("alloc exited, size = %lu, result = %lx\\n",
info.size, address);
}
return 0;
}
static inline int gen_alloc_exit(struct pt_regs *ctx) {
return gen_alloc_exit2(ctx, PT_REGS_RC(ctx));
}
static inline int gen_free_enter(struct pt_regs *ctx, void *address) {
u64 addr = (u64)address;
struct alloc_info_t *info = allocs.lookup(&addr);
if (info == 0)
return 0;
allocs.delete(&addr);
update_statistics_del(info->stack_id, info->size);
if (SHOULD_PRINT) {
bpf_trace_printk("free entered, address = %lx, size = %lu\\n",
address, info->size);
}
return 0;
}
int malloc_enter(struct pt_regs *ctx, size_t size) {
return gen_alloc_enter(ctx, size);
}
int malloc_exit(struct pt_regs *ctx) {
return gen_alloc_exit(ctx);
}
int free_enter(struct pt_regs *ctx, void *address) {
return gen_free_enter(ctx, address);
}
int calloc_enter(struct pt_regs *ctx, size_t nmemb, size_t size) {
return gen_alloc_enter(ctx, nmemb * size);
}
int calloc_exit(struct pt_regs *ctx) {
return gen_alloc_exit(ctx);
}
int realloc_enter(struct pt_regs *ctx, void *ptr, size_t size) {
gen_free_enter(ctx, ptr);
return gen_alloc_enter(ctx, size);
}
int realloc_exit(struct pt_regs *ctx) {
return gen_alloc_exit(ctx);
}
int mmap_enter(struct pt_regs *ctx) {
size_t size = (size_t)PT_REGS_PARM2(ctx);
return gen_alloc_enter(ctx, size);
}
int mmap_exit(struct pt_regs *ctx) {
return gen_alloc_exit(ctx);
}
int munmap_enter(struct pt_regs *ctx, void *address) {
return gen_free_enter(ctx, address);
}
int posix_memalign_enter(struct pt_regs *ctx, void **memptr, size_t alignment,
size_t size) {
u64 memptr64 = (u64)(size_t)memptr;
u64 pid = bpf_get_current_pid_tgid();
memptrs.update(&pid, &memptr64);
return gen_alloc_enter(ctx, size);
}
int posix_memalign_exit(struct pt_regs *ctx) {
u64 pid = bpf_get_current_pid_tgid();
u64 *memptr64 = memptrs.lookup(&pid);
void *addr;
if (memptr64 == 0)
return 0;
memptrs.delete(&pid);
if (bpf_probe_read_user(&addr, sizeof(void*), (void*)(size_t)*memptr64))
return 0;
u64 addr64 = (u64)(size_t)addr;
return gen_alloc_exit2(ctx, addr64);
}
int aligned_alloc_enter(struct pt_regs *ctx, size_t alignment, size_t size) {
return gen_alloc_enter(ctx, size);
}
int aligned_alloc_exit(struct pt_regs *ctx) {
return gen_alloc_exit(ctx);
}
int valloc_enter(struct pt_regs *ctx, size_t size) {
return gen_alloc_enter(ctx, size);
}
int valloc_exit(struct pt_regs *ctx) {
return gen_alloc_exit(ctx);
}
int memalign_enter(struct pt_regs *ctx, size_t alignment, size_t size) {
return gen_alloc_enter(ctx, size);
}
int memalign_exit(struct pt_regs *ctx) {
return gen_alloc_exit(ctx);
}
int pvalloc_enter(struct pt_regs *ctx, size_t size) {
return gen_alloc_enter(ctx, size);
}
int pvalloc_exit(struct pt_regs *ctx) {
return gen_alloc_exit(ctx);
}
"""
bpf_source_kernel_node = """
TRACEPOINT_PROBE(kmem, kmalloc_node) {
if (WORKAROUND_MISSING_FREE)
gen_free_enter((struct pt_regs *)args, (void *)args->ptr);
gen_alloc_enter((struct pt_regs *)args, args->bytes_alloc);
return gen_alloc_exit2((struct pt_regs *)args, (size_t)args->ptr);
}
TRACEPOINT_PROBE(kmem, kmem_cache_alloc_node) {
if (WORKAROUND_MISSING_FREE)
gen_free_enter((struct pt_regs *)args, (void *)args->ptr);
gen_alloc_enter((struct pt_regs *)args, args->bytes_alloc);
return gen_alloc_exit2((struct pt_regs *)args, (size_t)args->ptr);
}
"""
bpf_source_kernel = """
TRACEPOINT_PROBE(kmem, kmalloc) {
if (WORKAROUND_MISSING_FREE)
gen_free_enter((struct pt_regs *)args, (void *)args->ptr);
gen_alloc_enter((struct pt_regs *)args, args->bytes_alloc);
return gen_alloc_exit2((struct pt_regs *)args, (size_t)args->ptr);
}
TRACEPOINT_PROBE(kmem, kfree) {
return gen_free_enter((struct pt_regs *)args, (void *)args->ptr);
}
TRACEPOINT_PROBE(kmem, kmem_cache_alloc) {
if (WORKAROUND_MISSING_FREE)
gen_free_enter((struct pt_regs *)args, (void *)args->ptr);
gen_alloc_enter((struct pt_regs *)args, args->bytes_alloc);
return gen_alloc_exit2((struct pt_regs *)args, (size_t)args->ptr);
}
TRACEPOINT_PROBE(kmem, kmem_cache_free) {
return gen_free_enter((struct pt_regs *)args, (void *)args->ptr);
}
TRACEPOINT_PROBE(kmem, mm_page_alloc) {
gen_alloc_enter((struct pt_regs *)args, PAGE_SIZE << args->order);
return gen_alloc_exit2((struct pt_regs *)args, args->pfn);
}
TRACEPOINT_PROBE(kmem, mm_page_free) {
return gen_free_enter((struct pt_regs *)args, (void *)args->pfn);
}
"""
bpf_source_percpu = """
TRACEPOINT_PROBE(percpu, percpu_alloc_percpu) {
gen_alloc_enter((struct pt_regs *)args, args->size);
return gen_alloc_exit2((struct pt_regs *)args, (size_t)args->ptr);
}
TRACEPOINT_PROBE(percpu, percpu_free_percpu) {
return gen_free_enter((struct pt_regs *)args, (void *)args->ptr);
}
"""
if kernel_trace:
if args.percpu:
bpf_source += bpf_source_percpu
else:
bpf_source += bpf_source_kernel
if BPF.tracepoint_exists("kmem", "kmalloc_node"):
bpf_source += bpf_source_kernel_node
if kernel_trace:
bpf_source = bpf_source.replace("WORKAROUND_MISSING_FREE", "1"
if args.wa_missing_free else "0")
bpf_source = bpf_source.replace("SHOULD_PRINT", "1" if trace_all else "0")
bpf_source = bpf_source.replace("SAMPLE_EVERY_N", str(sample_every_n))
bpf_source = bpf_source.replace("PAGE_SIZE", str(resource.getpagesize()))
size_filter = ""
if min_size is not None and max_size is not None:
size_filter = "if (size < %d || size > %d) return 0;" % \
(min_size, max_size)
elif min_size is not None:
size_filter = "if (size < %d) return 0;" % min_size
elif max_size is not None:
size_filter = "if (size > %d) return 0;" % max_size
bpf_source = bpf_source.replace("SIZE_FILTER", size_filter)
stack_flags = "0"
if not kernel_trace:
stack_flags += "|BPF_F_USER_STACK"
bpf_source = bpf_source.replace("STACK_FLAGS", stack_flags)
if args.ebpf:
print(bpf_source)
exit()
bpf = BPF(text=bpf_source)
if not kernel_trace:
print("Attaching to pid %d, Ctrl+C to quit." % pid)
def attach_probes(sym, fn_prefix=None, can_fail=False, need_uretprobe=True):
if fn_prefix is None:
fn_prefix = sym
if args.symbols_prefix is not None:
sym = args.symbols_prefix + sym
try:
bpf.attach_uprobe(name=obj, sym=sym,
fn_name=fn_prefix + "_enter",
pid=pid)
if need_uretprobe:
bpf.attach_uretprobe(name=obj, sym=sym,
fn_name=fn_prefix + "_exit",
pid=pid)
except Exception:
if can_fail:
return
else:
raise
attach_probes("malloc")
attach_probes("calloc")
attach_probes("realloc")
attach_probes("mmap", can_fail=True) # failed on jemalloc
attach_probes("posix_memalign")
attach_probes("valloc", can_fail=True) # failed on Android, is deprecated in libc.so from bionic directory
attach_probes("memalign")
attach_probes("pvalloc", can_fail=True) # failed on Android, is deprecated in libc.so from bionic directory
attach_probes("aligned_alloc", can_fail=True) # added in C11
attach_probes("free", need_uretprobe=False)
attach_probes("munmap", can_fail=True, need_uretprobe=False) # failed on jemalloc
else:
print("Attaching to kernel allocators, Ctrl+C to quit.")
# No probe attaching here. Allocations are counted by attaching to
# tracepoints.
#
# Memory allocations in Linux kernel are not limited to malloc/free
# equivalents. It's also common to allocate a memory page or multiple
# pages. Page allocator have two interfaces, one working with page
# frame numbers (PFN), while other working with page addresses. It's
# possible to allocate pages with one kind of functions, and free them
# with another. Code in kernel can easy convert PFNs to addresses and
# back, but it's hard to do the same in eBPF kprobe without fragile
# hacks.
#
# Fortunately, Linux exposes tracepoints for memory allocations, which
# can be instrumented by eBPF programs. Tracepoint for page allocations
# gives access to PFNs for both allocator interfaces. So there is no
# need to guess which allocation corresponds to which free.
def print_outstanding():
print("[%s] Top %d stacks with outstanding allocations:" %
(datetime.now().strftime("%H:%M:%S"), top_stacks))
alloc_info = {}
allocs = bpf["allocs"]
stack_traces = bpf["stack_traces"]
for address, info in sorted(allocs.items(), key=lambda a: a[1].size):
if BPF.monotonic_time() - min_age_ns < info.timestamp_ns:
continue
if info.stack_id < 0:
continue
if info.stack_id in alloc_info:
alloc_info[info.stack_id].update(info.size)
else:
stack = list(stack_traces.walk(info.stack_id))
combined = []
for addr in stack:
combined.append(('0x'+format(addr, '016x')+'\t').encode('utf-8') + bpf.sym(addr, pid,
show_module=True, show_offset=True))
alloc_info[info.stack_id] = Allocation(combined,
info.size)
if args.show_allocs:
print("\taddr = %x size = %s" %
(address.value, info.size))
to_show = sorted(alloc_info.values(), key=alloc_sort_map[sort_key])[-top_stacks:]
for alloc in to_show:
print("\t%d bytes in %d allocations from stack\n\t\t%s" %
(alloc.size, alloc.count,
b"\n\t\t".join(alloc.stack).decode("ascii")))
def print_outstanding_combined():
stack_traces = bpf["stack_traces"]
stacks = sorted(bpf["combined_allocs"].items(),
key=combined_sort_map[sort_key])
cnt = 1
entries = []
for stack_id, info in stacks:
try:
trace = []
for addr in stack_traces.walk(stack_id.value):
sym = bpf.sym(addr, pid,
show_module=True,
show_offset=True)
trace.append(sym.decode('utf-8'))
trace = "\n\t\t".join(trace)
except KeyError:
trace = "stack information lost"
entry = ("\t%d bytes in %d allocations from stack\n\t\t%s" %
(info.total_size, info.number_of_allocs, trace))
entries.append(entry)
cnt += 1
if cnt > top_stacks:
break
print("[%s] Top %d stacks with outstanding allocations:" %
(datetime.now().strftime("%H:%M:%S"), top_stacks))
print('\n'.join(reversed(entries)))
count_so_far = 0
while True:
if trace_all:
print(bpf.trace_fields())
else:
try:
sleep(interval)
except KeyboardInterrupt:
exit()
if args.combined_only:
print_outstanding_combined()
else:
print_outstanding()
sys.stdout.flush()
count_so_far += 1
if num_prints is not None and count_so_far >= num_prints:
exit()