1#!/usr/bin/env python 2# 3# urandomread Example of instrumenting a kernel tracepoint. 4# For Linux, uses BCC, BPF. Embedded C. 5# 6# REQUIRES: Linux 4.7+ (BPF_PROG_TYPE_TRACEPOINT support). 7# 8# Test by running this, then in another shell, run: 9# dd if=/dev/urandom of=/dev/null bs=1k count=5 10# 11# Copyright 2016 Netflix, Inc. 12# Licensed under the Apache License, Version 2.0 (the "License") 13 14from __future__ import print_function 15from bcc import BPF 16 17# load BPF program 18b = BPF(text=""" 19TRACEPOINT_PROBE(random, urandom_read) { 20 // args is from /sys/kernel/debug/tracing/events/random/urandom_read/format 21 bpf_trace_printk("%d\\n", args->got_bits); 22 return 0; 23} 24""") 25 26# header 27print("%-18s %-16s %-6s %s" % ("TIME(s)", "COMM", "PID", "GOTBITS")) 28 29# format output 30while 1: 31 try: 32 (task, pid, cpu, flags, ts, msg) = b.trace_fields() 33 except ValueError: 34 continue 35 print("%-18.9f %-16s %-6d %s" % (ts, task, pid, msg)) 36