Closed YanzhaoLi closed 1 year ago
Same issue in ubuntu 20.04 as well, running the program /tools/execsnoop.py gives me:
base ❯ sudo ./execsnoop.py
Traceback (most recent call last):
File "./execsnoop.py", line 22, in <module>
from bcc.containers import filter_by_containers
ModuleNotFoundError: No module named 'bcc.containers'
The bpfcc-tools
version that gets installed is 0.12.0-2.
On another note, I simply used the "v0.10" branch's execsnoop.py and it worked. I guess using on using an older kernel like 5.4 or lesser, we need to make sure that a compatible version of bcc is used? There are certain bpf helper functions in the latest execsnoop.py file which won't run with a 5.4 kernel (which is what I'm running).
centos7
Linux 10-133-18-121 4.20.13-1.el7.elrepo.x86_64 #1 SMP Wed Feb 27 10:02:05 EST 2019 x86_64 x86_64 x86_64 GNU/Linux
exec opensnoop from bcc.containers import filter_by_containers ImportError: No module named containers
root@ubuntu:/tmp# python /home/qgb/github/ProcMon-for-Linux/build/_deps/bcc-src/tools/execsnoop.py Traceback (most recent call last): File "/home/qgb/github/ProcMon-for-Linux/build/_deps/bcc-src/tools/execsnoop.py", line 22, in <module> from bcc.containers import filter_by_containers
ImportError: No module named containers
root@ubuntu:/tmp# python
Python 2.7.17 (default, Jul 1 2022, 15:56:32)
[GCC 7.5.0] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import bcc
>>> bcc
<module 'bcc' from '/usr/lib/python2.7/dist-packages/bcc/__init__.pyc'>
>>> bcc.version.__version__
'0.10.0'
exit
Same issue in ubuntu 20.04
To get the latest BCC, the easist way is to build from source.
Since kernel version of recently ubuntu 16.04 has become 4.17. But with the official installing bcc doc on ubuntu16.04 , I installed bcc version 0.10. Thus I cannot use the tools/profiles.py for lacking bcc.containers module. How can I get a newer version of bcc on ubuntu16.04 without compiling bcc?