Resources for writing basic bpftrace tools as beginner

[shubhtrivedi]

Hi..

what are the prerequisites for writing a bpftrace tool?? Apart from basic syntax, upto which extent we must have knowledge of linux functions??
Any reference or documents which can help in better understanding apart from beginner's guide on this page ??

Thanks.

[fbs]

Useful to have is:

• know how to read C / experience reading code
• know about pointers
• have a basic idea of how operating systems work, virtual memory, processes/threads, etc

But what you need to write a tracer highly depends on the thing you want to trace. If you want ICMP packets it's not that hard and you should be able to grep your way through the linux source to figure out what to do. But if you dig deep down into the scary parts, schedulers, bio you're need dig (way) more.

[shubhtrivedi]

Thanks for the insight.

I needed a tool to debug latency in name resolution in my cluster. For the same, I used gethostlatency from inbuilt bpftrace script but since it is using uprobe it is not able to capture activities outside of the container in which bpftrace is running. Is there any kprobe corresponding to those functions which I can use??

[fbs]

What helps is to create a flow chart of how you think it works, in this case:

• application does a dns request through gethostbyname. (maybe go apps don't?)
• gethostbyname does a bunch of internal stuff like:
  • read /etc/hosts
  • do nsswitch things
  • parse /etc/resolv.conf
• if it needs to query a resolver it:
• creates a socket
• do a request
• parse the reply
• maybe do search domain magic

Based on this you have to find the best tracing point for your app.

Not sure how your cluster is setup but maybe you can do the logging from the resolver. Or find a way to attach to all containers (from the host)