search

tanelpoder / 0xtools

0x.Tools: X-Ray vision for Linux systems
https://0x.tools
GNU General Public License v2.0
1.41k stars 107 forks source link

add few syscalls to report dir as filename #17

Closed timurakhmadeev closed 1 year ago

timurakhmadeev commented 3 years ago

getdents, unlinkat calls can be seen when working with directories with large number of files/inodes. I'm not 100% sure it will work everywhere, and tested it on Ubuntu 20.04 only. It kinda works :)


Linux Process Snapper v0.18 by Tanel Poder [https://0x.tools]
Sampling /proc/syscall, wchan, stat for 3 seconds... finished.

=== Active Threads ======================================================================================================================

 samples | avg_threads | comm                   | state                  | syscall         | wchan                | filename             
-----------------------------------------------------------------------------------------------------------------------------------------
      17 |        0.53 | (rm)                   | Disk (Uninterruptible) | unlinkat        | jbd2_log_wait_commit | /home/tiak/psn-test  
      11 |        0.34 | (rm)                   | Disk (Uninterruptible) | unlinkat        | rq_qos_wait          | /home/tiak/psn-test  
       9 |        0.28 | (jbd*/dm-*-*)          | Disk (Uninterruptible) | [kernel_thread] | __wait_on_buffer     |                      
       7 |        0.22 | (jbd*/dm-*-*)          | Disk (Uninterruptible) | [kernel_thread] | rq_qos_wait          |                      
       3 |        0.09 | (llvmpipe-*)           | Running (ON CPU)       | [running]       | 0                    |                      
       3 |        0.09 | (rm)                   | Running (ON CPU)       | [running]       | 0                    |                      
       1 |        0.03 | (kworker/*:*H+kblockd) | Running (ON CPU)       | [running]       | 0                    |                      
       1 |        0.03 | (rcu_sched)            | Running (ON CPU)       | [running]       | 0                    |                      
       1 |        0.03 | (rm)                   | Disk (Uninterruptible) | unlinkat        | submit_bio_wait      | /home/tiak/psn-test
timurakhmadeev commented 3 years ago

Work in Oracle Linux too

   3116 |       18.12 | (XXXXXXXXXXX)     | Disk (Uninterruptible) | getdents        | iterate_dir           | <snipped>/log
    142 |        0.83 | (XXXXXXXXXXX)     | Disk (Uninterruptible) | getdents        | rpc_wait_bit_killable | <snipped>/log
tanelpoder commented 3 years ago

Great addition! There may be more syscalls that have a single file descriptor as an argument, so they all could be enhanced. If you find any, more PRs welcome :-) I was gonna write some wild grep command for finding all of them programmatically, but haven't gotten to this yet. I'll merge this to the next release.

timurakhmadeev commented 3 years ago

Welcome, Tanel! As you wish :)