bpftrace使用

1. 单一挂载

   1 2 3 4 5 6 7 8 9 10 11 12 13

   bpftrace -e 'uprobe:/usr/local/nginx/sbin/nginx:ngx_close_connection{printf("close connection\n");}' ## 挂载点 相当于 hook ## uprobe:/usr/local/nginx/sbin/nginx:ngx_close_connection{ ## / cond / 条件 ## printf("close connection\n"); 执行动作 ## } bpftrace -l "*accept*" # 列出所有包含accept的可挂载点 bpftrace -e "tracepoint:syscalls:sys_enter_accept{printf("accept\n");}" bpftrace -e "tracepoint:syscalls:sys_enter_accept{printf("accept %s\n",comm);}" bpftrace -lv "tracepoint:syscalls:sys_enter_read" # 查看挂载点参数，参数可以用args和arg1...取出

2. 多挂载

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

   // network.bt tracepoint:syscalls:sys_enter_accept4 { printf("accept4 %s\n", comm); } tracepoint:syscalls:sys_enter_accept { printf("accept %s\n", comm); } tracepoint:syscalls:sys_enter_connect { printf("connect"); } tracepoint:syscalls:sys_enter_read / comm == "ngnix" / { printf(" read %s, %d, buf:%s \n", comm, pid , str(args->buf)); }

   1	bpftrace network.bt

3. bpftrace实现tcpdump

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

   ##include <net/sock.h> BEGIN { printf("%8s %6s %15s", "TIME", "PID", "COMM"); printf("%20s %6s %20s %6s\n", "RADDR", "RPORT", "LADDR", "LPORT"); } kretprobe:inet_csk_accept { $sk = (struct sock*)retval; $raddr = ntop($sk->__sk_common.skc_daddr); $laddr = ntop($sk->__sk_common.skc_rcv_saddr); time("%H:%M:%S"); printf("%6d %15s", pid, comm); printf("%20s, %20s\n", $radd, $laddr); }

4. bpftrace实现文件读写跟踪

   1 2 3 4 5 6 7 8 9 10 11 12 13 14

   ##include <linux/fs.h> ##include <linux/path.h> ##include <linux/dcache.h> kprobe:vfs_open / comm == "cat" / { printf("vfs_open: %s, name: %s\n", comm, str(((struct path*)arg0)->dentry->d_name.name)); } kprobe:vfs_write / comm == "cat" / { $file = str(((struct path*)arg0)->f_path.dentry->d_name.name); printf("vfs_write: %s,count: %d, buf:%s\n", $file, arg2, str(arg1)); }

5. bpftrace跟踪写裸盘

   1	bpftrace -e "kprobe:nvme_submit_io{printf("submit io\n");}"

6. bpftrace跟踪ext4

   1 2 3 4 5 6 7

   ##include <linux/fs.h> ##include <linux/path.h> ##include <linux/dcache.h> kprobe:ext4_file_open { printf("ext4_file_open %s, filename:%s\n", comm, str(((struct path*)arg0)->f_path.dentry->d_name.name)); }

7. bpftrace跟踪内存泄漏

   1 2 3 4 5 6 7 8 9 10 11

   uretprobe:/lib/x86_64-linux-gnu/libc.so.6:malloc / comm == "memleak" / { $ret = retval; printf("malloc : %p \n", $ret); } uretprobe:/lib/x86_64-linux-gnu/libc.so.6:free / comm == "memleak" / { printf("free : %p \n", arg0); }

probes

bpftrace原理

• 将挂载的执行体嵌入到进程elf的代码段相应的位置