ubuntu16.04 install newer bcc version

[YanzhaoLi]

Since kernel version of recently ubuntu 16.04 has become 4.17. But with the official installing bcc doc on ubuntu16.04 , I installed bcc version 0.10. Thus I cannot use the tools/profiles.py for lacking bcc.containers module. How can I get a newer version of bcc on ubuntu16.04 without compiling bcc?

[atul-g]

Same issue in ubuntu 20.04 as well, running the program /tools/execsnoop.py gives me:

base ❯ sudo ./execsnoop.py         
Traceback (most recent call last):
  File "./execsnoop.py", line 22, in <module>
    from bcc.containers import filter_by_containers
ModuleNotFoundError: No module named 'bcc.containers'

The bpfcc-tools version that gets installed is 0.12.0-2.

[atul-g]

On another note, I simply used the "v0.10" branch's execsnoop.py and it worked. I guess using on using an older kernel like 5.4 or lesser, we need to make sure that a compatible version of bcc is used? There are certain bpf helper functions in the latest execsnoop.py file which won't run with a 5.4 kernel (which is what I'm running).

[timchenxiaoyu]

centos7

Linux 10-133-18-121 4.20.13-1.el7.elrepo.x86_64 #1 SMP Wed Feb 27 10:02:05 EST 2019 x86_64 x86_64 x86_64 GNU/Linux

exec opensnoop from bcc.containers import filter_by_containers ImportError: No module named containers

[QGB]

 root@ubuntu:/tmp# python /home/qgb/github/ProcMon-for-Linux/build/_deps/bcc-src/tools/execsnoop.py                                   Traceback (most recent call last):                                                                                                     File "/home/qgb/github/ProcMon-for-Linux/build/_deps/bcc-src/tools/execsnoop.py", line 22, in <module>                                 from bcc.containers import filter_by_containers                                                                                
  ImportError: No module named containers

root@ubuntu:/tmp# python
Python 2.7.17 (default, Jul  1 2022, 15:56:32)
[GCC 7.5.0] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import bcc
>>> bcc
<module 'bcc' from '/usr/lib/python2.7/dist-packages/bcc/__init__.pyc'>

>>> bcc.version.__version__
'0.10.0'
exit

[tfxidian]

Same issue in ubuntu 20.04

[chenhengqi]

To get the latest BCC, the easist way is to build from source.