add threadsnoop tool

README.md

@@ -173,6 +173,7 @@ bpftrace contains various tools, which also serve as examples of programming in
 - tools/[tcplife](tools/tcplife.bt): Trace TCP session lifespans with connection details. [Examples](tools/tcplife_example.txt).
 - tools/[tcpretrans](tools/tcpretrans.bt): Trace TCP retransmits. [Examples](tools/tcpretrans_example.txt).
 - tools/[tcpsynbl](tools/tcpsynbl.bt): Show TCP SYN backlog as a histogram. [Examples](tools/tcpsynbl_example.txt).
+- tools/[threadsnoop](tools/threadsnoop.bt): List new thread creation. [Examples](tools/threadsnoop_example.txt).
 - tools/[vfscount.bt](tools/vfscount.bt): Count VFS calls. [Examples](tools/vfscount_example.txt).
 - tools/[vfsstat.bt](tools/vfsstat.bt): Count some VFS calls, with per-second summaries. [Examples](tools/vfsstat_example.txt).
 - tools/[writeback.bt](tools/writeback.bt): Trace file system writeback events with details. [Examples](tools/writeback_example.txt).

man/man8/threadsnoop.8

@@ -0,0 +1,60 @@
+.TH threadsnoop 8  "2019-07-02" "USER COMMANDS"
+.SH NAME
+threadsnoop.bt \- Trace thread creation via pthread_create(). Uses bpftrace/eBPF.
+.SH SYNOPSIS
+.B threadsnoop.bt
+.SH DESCRIPTION
+threadsnoop traces calls to pthread_create(), showing this path of thread
+creation. This can be used for workload characterization and discovery, and is
+a companion to execsnoop(8) which traces execve(2).
+
+This works by tracing the pthread_create() from libpthread.so.0. The path
+to this library may need adjusting in the tool source to match your system.
+
+Since this uses BPF, only the root user can use this tool.
+.SH REQUIREMENTS
+CONFIG_BPF and bpftrace.
+.SH EXAMPLES
+.TP
+Trace calls pthread_create():
+#
+.B threadsnoop.bt
+.SH FIELDS
+.TP
+TIME(ms)
+Elapsed time since the tool began tracing (in milliseconds).
+.TP
+PID
+The process ID.
+.TP
+COMM
+The process (thread) name.
+.TP
+FUNC
+The name of the start routine, if the symbol is available, else a hex address
+for the start routine address.
+.SH OVERHEAD
+Thread creation is expected to be low (<< 1000/s), so the overhead of this
+tool is expected to be negligible.
+.SH SOURCE
+This tool originated from the book "BPF Performance Tools", published by
+Addison Wesley (2019):
+.IP
+http://www.brendangregg.com/bpf-performance-tools-book.html
+.PP
+See the book for more documentation on this tool.
+.PP
+This version is in the bpftrace repository:
+.IP
+https://github.com/iovisor/bpftrace
+.PP
+Also look in the bpftrace distribution for a companion _examples.txt file
+containing example usage, output, and commentary for this tool.
+.SH OS
+Linux
+.SH STABILITY
+Unstable - in development.
+.SH AUTHOR
+Brendan Gregg
+.SH SEE ALSO
+execsnoop(8)

tools/threadsnoop.bt

@@ -0,0 +1,25 @@
+#!/usr/local/bin/bpftrace
+/*
+ * threadsnoop - List new thread creation.
+ *
+ * See BPF Performance Tools, Chapter 13, for an explanation of this tool.
+ *
+ * Copyright (c) 2019 Brendan Gregg.
+ * Licensed under the Apache License, Version 2.0 (the "License").
+ * This was originally created for the BPF Performance Tools book
+ * published by Addison Wesley. ISBN-13: 9780136554820
+ * When copying or porting, include this comment.
+ *
+ * 15-Feb-2019  Brendan Gregg   Created this.
+ */
+
+BEGIN
+{
+	printf("%-10s %-6s %-16s %s\n", "TIME(ms)", "PID", "COMM", "FUNC");
+}
+
+uprobe:/lib/x86_64-linux-gnu/libpthread.so.0:pthread_create
+{
+	printf("%-10u %-6d %-16s %s\n", elapsed / 1000000, pid, comm,
+	    usym(arg2));
+}

tools/threadsnoop_example.txt

@@ -0,0 +1,27 @@
+Demonstrations of threadsnoop, the Linux bpftrace/eBPF version.
+
+
+Tracing new threads via phtread_create():
+
+# ./threadsnoop.bt
+Attaching 2 probes...
+TIME(ms)   PID    COMM             FUNC
+1938       28549  dockerd          threadentry
+1939       28549  dockerd          threadentry
+1939       28549  dockerd          threadentry
+1940       28549  dockerd          threadentry
+1949       28549  dockerd          threadentry
+1958       28549  dockerd          threadentry
+1939       28549  dockerd          threadentry
+1950       28549  dockerd          threadentry
+2013       28579  docker-containe  0x562f30f2e710
+2036       28549  dockerd          threadentry
+2083       28579  docker-containe  0x562f30f2e710
+2116       629    systemd-journal  0x7fb7114955c0
+2116       629    systemd-journal  0x7fb7114955c0
+[...]
+
+The output shows a dockerd process creating several threads with the start
+routine threadentry(), and docker-containe (truncated) and systemd-journal
+also starting threads: in their cases, the function had no symbol information
+available, so their addresses are printed in hex.