search

iovisor / bcc

BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
Apache License 2.0
19.95k stars 3.81k forks source link

can we use iovisor tools for virtual machine introspection... #485

Open TahirAhmed916 opened 8 years ago

TahirAhmed916 commented 8 years ago

Hi I am working on IOVIOSR. I have implemented IOVISOR tools and got the output. But my purpose is different. I am working on libvmi. I have a machine on KVM hyper-visor running on my Ubuntu machine. Is there possible to get information about machine running on KVM from my Ubuntu machine where i have IOVISOR. Kindly guide me in this sense. Thanks

brendangregg commented 8 years ago

This question isn't very clear: are you trying to observe a guest from the host? Host from the guest? Host kernel resource events (incl. block I/O) triggered by the guest? ... What information are you trying to see?

TahirAhmed916 commented 8 years ago

I am trying to observe guest from host machine.

brendangregg commented 8 years ago

Ok, guest %CPU usage for the entire guest? Use top. If you mean something else, you're going to have to be more specific.

TahirAhmed916 commented 8 years ago

Can i use HTTP filter to monitor guest OS HTTP traffic. I tried to check tcp-connections on guest OS from Host but no output found. And can i get info about processes running on guest OS or not.?

brendangregg commented 8 years ago

Guest HTTP traffic, at least 4 options:

  1. Does the hypervisor handle the packets, or is it pass-through to the device? If it's the former, then I imagine one could use kprobes on the network device driver on the host, and parse packets in BPF (there was an example of such a parser in /examples).
  2. Guest kernel tracing: you'll need a symbol dump of the guest kernel, and then could try uprobes of the KVM process. There's been lots of discussions about doing this, I don't know offhand if anyone has a working solution yet, but it's believed to be possible.
  3. Guest user space tracing of the HTTP code: probably similar to (2), provided you can get a symbol dump, then uprobe that address.
  4. SSH onto the guest and trace it there. Yes, it's cheating, but worth having on this list.

Processes running on the guest OS:

Is any of this possible? Probably. Are there canned tools or examples? Not yet.

krkini16 commented 7 years ago

As a followup to this question, I am having issues making BCC play nicely with network namespaces (that is a virtual copy of the network stack within my machine running Ubuntu 14.04).

Is this expected behavior? I am investigating now, but insights are appreciated.

williamtu commented 7 years ago

Hi, I wonder if anyone tries the (2) mentioned above: Guest kernel tracing: you'll need a symbol dump of the guest kernel, and then could try uprobes of the KVM process. There's been lots of discussions about doing this, I don't know offhand if anyone has a working solution yet, but it's believed to be possible.

At host, I want to use 'trace' to trace a packet TX's sk_buff from VM to virtual switch in host and eventually to driver. I think it's a pretty cool feature and could replace the existing VMI tools. Thanks. --William