search

iovisor / bcc

BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
Apache License 2.0
20.23k stars 3.84k forks source link

Application stack trace on oomkill. #3654

Open syamajala opened 2 years ago

syamajala commented 2 years ago

Is it possible to get an application level stack trace on oomkill? Are there any examples of how I might write a script to do something like that?

davemarchevsky commented 2 years ago

tools/oomkill.py (and associated tools/oomkill_example.txt) are a good start. You'd have to add a bpf_get_task_stack call and associated changes to oomkill's perf buf output.

This would be a useful feature to add to oomkill so if you end up doing this please send a PR!

brendangregg commented 2 years ago

Thanks, it would be a good addition. I wonder why I didn't do it. Note that you'd need to trace the application's receipt of the signal so you were in the right context for pulling a stack, so this would, involve adding a probe and a filter and state.

I'd consider giving it a switch, like -s for stack.

syamajala commented 2 years ago

@brendangregg do you mean i need to trace SIGKILL?

Why isnt it enough to call bpf_get_task_stack on p?

jshowacre commented 2 years ago

I don't believe the application has received the signal at that point in the kprobe. I wonder if adding a kretfunc on send_signal would be viable.

brendangregg commented 2 years ago

Ah thanks @syamajala and @davemarchevsky, you're right, this could just use the newer bpf_get_task_stack() call.

irenge commented 2 years ago

Hi Is this issue still open ? It sounds interesting. I d like to have a work on it

vanzei commented 2 months ago

Hi, I'm new to Open Source and very curious about eBPF / BCC.

Looking into the open issues, as good first I crossed with this one which looking into @brendangregg comments I have an idea how to implement and I started documenting it as the Contributing page shows for biolatency. Is there a way I can learn how to test it properly before making a PR?