hi，when I run offcputime with specifying pid, its output is empty. But it works without specifying pid. This problem is very similar to https://github.com/iovisor/bcc/issues/1566. But our environment is different and the solution in issues-1566 is useless here. Thanks.

my environment: $uname -r 4.19.95-27 $cat /etc/redhat-release CentOS Linux release 7.9.2009 (Core)

PS, the output with --ebpf is :

include <uapi/linux/ptrace.h>

include <linux/sched.h>

define MINBLOCK_US 1ULL

define MAXBLOCK_US 18446744073709551615ULL

struct key_t { u32 pid; u32 tgid; int user_stack_id; int kernel_stack_id; char name[TASK_COMM_LEN]; }; BPF_HASH(counts, struct key_t); BPF_HASH(start, u32); BPF_STACK_TRACE(stack_traces, 1024);

struct rq;

int oncpu(struct pt_regs ctx, struct rq rq, struct task_struct prev) { u32 pid = prev->pid; u32 tgid = prev->tgid; u64 ts, tsp;

// record previous thread sleep time if ((tgid == 28) && (1)) { ts = bpf_ktime_get_ns(); start.update(&pid, &ts); }

// get the current thread's start time pid = bpf_get_current_pid_tgid(); tgid = bpf_get_current_pid_tgid() >> 32; tsp = start.lookup(&pid); if (tsp == 0) { return 0; // missed start or filtered }

// calculate current thread's delta time u64 delta = bpf_ktime_get_ns() - *tsp; start.delete(&pid); delta = delta / 1000; if ((delta < MINBLOCK_US) || (delta > MAXBLOCK_US)) { return 0; }

// create map key struct key_t key = {};

key.pid = pid; key.tgid = tgid; key.user_stack_id = stack_traces.get_stackid(ctx, BPF_F_USER_STACK); key.kernel_stack_id = stack_traces.get_stackid(ctx, 0); bpf_get_current_comm(&key.name, sizeof(key.name));

counts.increment(key, delta); return 0; }

iovisor / bcc

offcputime result is empty when I try to attach it to a specific process #3955

include <uapi/linux/ptrace.h>

include <linux/sched.h>

define MINBLOCK_US 1ULL

define MAXBLOCK_US 18446744073709551615ULL