iovisor/bcc

update killsnoop to use tracepoints

開放

#3,592 建立於 2021年8月27日

 (7 則留言) (0 個反應) (1 位負責人)C (4,074 個分叉)batch import
help wanted

倉庫指標

星標
 (22,632 顆星)
PR 合併指標
 (平均合併 12天 6小時) (30 天內合併 12 個 PR)

描述

This is a request for help.

I wrote killsnoop back in 2015 before tracepoint support, and so I kprobe'd sys_kill(). It still does some derivation of that. But now there's a report it no longer works on Linux 5.11: https://github.com/iovisor/bcc/pull/3572#issuecomment-900357032 CC @chenhengqi

Can someone please update killsnoop (both Python and libbpf-tools) to use tracepoints instead of kprobes (if it works as expected). All of these:

  syscalls:sys_enter_kill                            [Tracepoint event]
  syscalls:sys_enter_tgkill                          [Tracepoint event]
  syscalls:sys_enter_tkill                           [Tracepoint event]
  syscalls:sys_exit_kill                             [Tracepoint event]
  syscalls:sys_exit_tgkill                           [Tracepoint event]
  syscalls:sys_exit_tkill                            [Tracepoint event]

貢獻者指南