BCC - Linux öndürijiligine gözegçilik, tor we ş.m. üçin dinamiki gözleg gurallary


BCC (BPF düzüjiler ýygyndysy), ýadro gözleg we manipulýasiýa programmalaryny döretmek üçin degişli gurallaryň we mysal faýllarynyň güýçli toplumydyr. Linux 3.15-de täze aýratynlyklaryň biri bolan eBPF diýlip atlandyrylýan giňeldilen BPF (Berkeli paket süzgüçleri) ulanýar.

Iş ýüzünde, BCC tarapyndan ulanylýan komponentleriň köpüsi Linux 4.1 ýa-da ondan ýokary talap edýär we onuň bellemeli aýratynlyklary şulary öz içine alýar:

  1. 3-nji tarap ýadro modulyny talap etmeýär, sebäbi ähli gurallar ýadro gurlan BPF esasly işleýär we BCC Linux 4.x seriýasynda goşulan aýratynlyklary ulanýar.
  2. Programma üpjünçiliginiň ýerine ýetirilişine gözegçilik etmäge mümkinçilik berýär.
  3. Mysal faýllary we adam sahypalary bilen birnäçe öndürijilik derňew gurallaryndan ybarat.

Öňdebaryjy Linux ulanyjylary üçin iň amatlysy, BCC, C ýadrosy gurallaryny ulanyp, BPF programmalaryny, Python we lua-da öň taraplaryny ýazmagy aňsatlaşdyrýar. Mundan başga-da, öndürijilik derňewi, gözegçilik, tor traffigine gözegçilik we başga-da köp meseläni goldaýar.

Linux ulgamlarynda BCC-ni nädip gurmaly

BCC Linux ýadrosynyň 4.1 ýa-da ondan ýokary wersiýasynda goşulan aýratynlyklary ulanýandygyny ýadyňyzdan çykarmaň, talap hökmünde ýadro aşakda görkezilen baýdaklar bilen düzülen bolmaly:

CONFIG_BPF=y
CONFIG_BPF_SYSCALL=y
# [optional, for tc filters]
CONFIG_NET_CLS_BPF=m
# [optional, for tc actions]
CONFIG_NET_ACT_BPF=m
CONFIG_BPF_JIT=y
CONFIG_HAVE_BPF_JIT=y
# [optional, for kprobes]
CONFIG_BPF_EVENTS=y

Ernadro baýdaklaryňyzy barlamak üçin /proc/config.gz faýly görüň ýa-da aşakdaky mysallardaky ýaly buýruklary işlediň:

[email  ~ $ grep CONFIG_BPF= /boot/config-`uname -r`
CONFIG_BPF=y
[email  ~ $ grep CONFIG_BPF_SYSCALL= /boot/config-`uname -r`
CONFIG_BPF_SYSCALL=y
[email  ~ $ grep CONFIG_NET_CLS_BPF= /boot/config-`uname -r`
CONFIG_NET_CLS_BPF=m
[email  ~ $ grep CONFIG_NET_ACT_BPF= /boot/config-`uname -r`
CONFIG_NET_ACT_BPF=m
[email  ~ $ grep CONFIG_BPF_JIT= /boot/config-`uname -r`
CONFIG_BPF_JIT=y
[email  ~ $ grep CONFIG_HAVE_BPF_JIT= /boot/config-`uname -r`
CONFIG_HAVE_BPF_JIT=y
[email  ~ $ grep CONFIG_BPF_EVENTS= /boot/config-`uname -r`
CONFIG_BPF_EVENTS=y

Ernadro baýdaklaryny barlandan soň, Linux ulgamlaryna BCC gurallaryny gurmagyň wagty geldi.

Ubuntu 16.04 üçin diňe gijeki paketler döredilýär, ýöne gurnama görkezmeleri gaty gönümel. Ernadrosy täzelemegiň ýa-da çeşmeden düzmegiň zerurlygy ýok.

$ echo "deb [trusted=yes] https://repo.iovisor.org/apt/xenial xenial-nightly main" | sudo tee /etc/apt/sources.list.d/iovisor.list
$ sudo apt-get update
$ sudo apt-get install bcc-tools

Http://kernel.ubuntu.com/~kernel-ppa/mainline-den 4.3+ Linux ýadrosyny gurup başlaň.

Mysal üçin, aşakdaky mazmunly kiçijik gabyk skriptini “bcc-install.sh” ýazyň.

Bellik: PREFIX bahasyny iň soňky senä täzeläň, şeýle hem hakyky REL bahasyny almak üçin berlen PREFIX url-daky faýllara göz aýlaň, gabyk skriptinde çalşyň.

#!/bin/bash
VER=4.5.1-040501
PREFIX=http://kernel.ubuntu.com/~kernel-ppa/mainline/v4.5.1-wily/
REL=201604121331
wget ${PREFIX}/linux-headers-${VER}-generic_${VER}.${REL}_amd64.deb
wget ${PREFIX}/linux-headers-${VER}_${VER}.${REL}_all.deb
wget ${PREFIX}/linux-image-${VER}-generic_${VER}.${REL}_amd64.deb
sudo dpkg -i linux-*${VER}.${REL}*.deb

Faýly ýazdyryň we çykyň. Ony ýerine ýetirip boluň, soňra görkezilişi ýaly işlediň:

$ chmod +x bcc-install.sh
$ sh bcc-install.sh

Ondan soň ulgamyňyzy täzeden açyň.

$ reboot

Ondan soň, gol çekilen BCC paketlerini gurmak üçin aşakdaky buýruklary işlediň:

$ sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys D4284CDD
$ echo "deb https://repo.iovisor.org/apt trusty main" | sudo tee /etc/apt/sources.list.d/iovisor.list
$ sudo apt-get update
$ sudo apt-get install binutils bcc bcc-tools libbcc-examples python-bcc

Ulgamyňyzyň talap edilýäninden pes wersiýasy bar bolsa, http://alt.fedoraproject.org/pub/alt/rawhide-kernel-nodebug-dan 4.2+ ýadro guruň. Aşakda muny nädip etmelidiginiň mysaly:

$ sudo dnf config-manager --add-repo=http://alt.fedoraproject.org/pub/alt/rawhide-kernel-nodebug/fedora-rawhide-kernel-nodebug.repo
$ sudo dnf update
$ reboot

Ondan soň, BBC gurallar ammaryny goşuň, ulgamyňyzy täzeläň we indiki seriýalary ýerine ýetirip gurallary guruň:

$ echo -e '[iovisor]\nbaseurl=https://repo.iovisor.org/yum/nightly/f23/$basearch\nenabled=1\ngpgcheck=0' | sudo tee /etc/yum.repos.d/iovisor.repo
$ sudo dnf update
$ sudo dnf install bcc-tools

Ernadrosyňyzy iň bolmanda 4.3.1-1 wersiýasyna çenli ýokarlandyryp başlamaly, soňundan paket, ýaourt, kower we ş.m. ýaly Arch paket dolandyryjylaryny ulanyp, aşakdaky paketleri gurmaly.

bcc bcc-tools python-bcc python2-bcc

Linux ulgamlarynda BCC gurallaryny nädip ulanmaly

BCC gurallarynyň hemmesi /usr/share/bcc/tools katalogynyň aşagynda gurnaldy. Şeýle-de bolsa, olary BCC Github ammaryndan /tools astynda işledip bilersiňiz, ol ýerde .py giňeltmesi bilen gutarýar.

$ ls /usr/share/bcc/tools 

argdist       capable     filetop         offwaketime  stackcount  vfscount
bashreadline  cpudist     funccount       old          stacksnoop  vfsstat
biolatency    dcsnoop     funclatency     oomkill      statsnoop   wakeuptime
biosnoop      dcstat      gethostlatency  opensnoop    syncsnoop   xfsdist
biotop        doc         hardirqs        pidpersec    tcpaccept   xfsslower
bitesize      execsnoop   killsnoop       profile      tcpconnect  zfsdist
btrfsdist     ext4dist    mdflush         runqlat      tcpconnlat  zfsslower
btrfsslower   ext4slower  memleak         softirqs     tcpretrans
cachestat     filelife    mysqld_qslower  solisten     tplist
cachetop      fileslower  offcputime      sslsniff     trace

Linux ulgamynyň umumy işleýşine we torlaýyn işleýşine gözegçilik etmek üçin birnäçe mysal getireris.

“Opennoop” ulanyp, ähli open() syskalaryny gözlemekden başlalyň. Bu, dürli faýllaryň maglumat faýllaryny, konfigurasiýa faýllaryny we başga-da köp zatlary kesgitlemek arkaly işleýändigini bize aýdýar:

$ cd /usr/share/bcc/tools 
$ sudo ./opensnoop

PID    COMM               FD ERR PATH
1      systemd            35   0 /proc/self/mountinfo
2797   udisksd            13   0 /proc/self/mountinfo
1      systemd            35   0 /sys/devices/pci0000:00/0000:00:0d.0/ata3/host2/target2:0:0/2:0:0:0/block/sda/sda1/uevent
1      systemd            35   0 /run/udev/data/b8:1
1      systemd            -1   2 /etc/systemd/system/sys-kernel-debug-tracing.mount
1      systemd            -1   2 /run/systemd/system/sys-kernel-debug-tracing.mount
1      systemd            -1   2 /run/systemd/generator/sys-kernel-debug-tracing.mount
1      systemd            -1   2 /usr/local/lib/systemd/system/sys-kernel-debug-tracing.mount
2247   systemd            15   0 /proc/self/mountinfo
1      systemd            -1   2 /lib/systemd/system/sys-kernel-debug-tracing.mount
1      systemd            -1   2 /usr/lib/systemd/system/sys-kernel-debug-tracing.mount
1      systemd            -1   2 /run/systemd/generator.late/sys-kernel-debug-tracing.mount
1      systemd            -1   2 /etc/systemd/system/sys-kernel-debug-tracing.mount.wants
1      systemd            -1   2 /etc/systemd/system/sys-kernel-debug-tracing.mount.requires
1      systemd            -1   2 /run/systemd/system/sys-kernel-debug-tracing.mount.wants
1      systemd            -1   2 /run/systemd/system/sys-kernel-debug-tracing.mount.requires
1      systemd            -1   2 /run/systemd/generator/sys-kernel-debug-tracing.mount.wants
1      systemd            -1   2 /run/systemd/generator/sys-kernel-debug-tracing.mount.requires
1      systemd            -1   2 /usr/local/lib/systemd/system/sys-kernel-debug-tracing.mount.wants
1      systemd            -1   2 /usr/local/lib/systemd/system/sys-kernel-debug-tracing.mount.requires
1      systemd            -1   2 /lib/systemd/system/sys-kernel-debug-tracing.mount.wants
1      systemd            -1   2 /lib/systemd/system/sys-kernel-debug-tracing.mount.requires
1      systemd            -1   2 /usr/lib/systemd/system/sys-kernel-debug-tracing.mount.wants
1      systemd            -1   2 /usr/lib/systemd/system/sys-kernel-debug-tracing.mount.requires
1      systemd            -1   2 /run/systemd/generator.late/sys-kernel-debug-tracing.mount.wants
1      systemd            -1   2 /run/systemd/generator.late/sys-kernel-debug-tracing.mount.requires
1      systemd            -1   2 /etc/systemd/system/sys-kernel-debug-tracing.mount.d
1      systemd            -1   2 /run/systemd/system/sys-kernel-debug-tracing.mount.d
1      systemd            -1   2 /run/systemd/generator/sys-kernel-debug-tracing.mount.d
....

Bu mysalda, biolatecncy ulanyp, disk I/O gijikdirilişiniň jemlenen paýlanyşyny görkezýär. Buýrugy ýerine ýetireniňizden soň, birnäçe minut garaşyň we gutarmak we çykyşy görmek üçin Ctrl-C basyň.

$ sudo ./biolatecncy

Tracing block device I/O... Hit Ctrl-C to end.
^C
     usecs               : count     distribution
         0 -> 1          : 0        |                                        |
         2 -> 3          : 0        |                                        |
         4 -> 7          : 0        |                                        |
         8 -> 15         : 0        |                                        |
        16 -> 31         : 0        |                                        |
        32 -> 63         : 0        |                                        |
        64 -> 127        : 0        |                                        |
       128 -> 255        : 3        |****************************************|
       256 -> 511        : 3        |****************************************|
       512 -> 1023       : 1        |*************                           |

Bu bölümde, execsnoop guralyny ulanyp, ýerine ýetirilişde täze prosesleri yzarlamaga geçeris. Her gezek bir amal fork() we exec() syscalls tarapyndan gysylanda, çykyşda görkezilýär. Şeýle-de bolsa, ähli amallar ele alynmaýar.

$ sudo ./execsnoop

PCOMM            PID    PPID   RET ARGS
gnome-screensho  14882  14881    0 /usr/bin/gnome-screenshot --gapplication-service
systemd-hostnam  14892  1        0 /lib/systemd/systemd-hostnamed
nautilus         14897  2767    -2 /home/tecmint/bin/net usershare info
nautilus         14897  2767    -2 /home/tecmint/.local/bin/net usershare info
nautilus         14897  2767    -2 /usr/local/sbin/net usershare info
nautilus         14897  2767    -2 /usr/local/bin/net usershare info
nautilus         14897  2767    -2 /usr/sbin/net usershare info
nautilus         14897  2767    -2 /usr/bin/net usershare info
nautilus         14897  2767    -2 /sbin/net usershare info
nautilus         14897  2767    -2 /bin/net usershare info
nautilus         14897  2767    -2 /usr/games/net usershare info
nautilus         14897  2767    -2 /usr/local/games/net usershare info
nautilus         14897  2767    -2 /snap/bin/net usershare info
compiz           14899  14898   -2 /home/tecmint/bin/libreoffice --calc
compiz           14899  14898   -2 /home/tecmint/.local/bin/libreoffice --calc
compiz           14899  14898   -2 /usr/local/sbin/libreoffice --calc
compiz           14899  14898   -2 /usr/local/bin/libreoffice --calc
compiz           14899  14898   -2 /usr/sbin/libreoffice --calc
libreoffice      14899  2252     0 /usr/bin/libreoffice --calc
dirname          14902  14899    0 /usr/bin/dirname /usr/bin/libreoffice
basename         14903  14899    0 /usr/bin/basename /usr/bin/libreoffice
...

“Ext4slower” -i ulanyp, “104” -den has haýal bolan “ext4” faýl ulgamynyň umumy amallaryny yzarlamak, faýl ulgamy arkaly özbaşdak haýal disk I/O kesgitlemäge kömek etmek üçin.

Diňe çäkden geçýän amallary çykarýar:

$ sudo ./execslower

Tracing ext4 operations slower than 10 ms
TIME     COMM           PID    T BYTES   OFF_KB   LAT(ms) FILENAME
11:59:13 upstart        2252   W 48      1          10.76 dbus.log
11:59:13 gnome-screensh 14993  R 144     0          10.96 settings.ini
11:59:13 gnome-screensh 14993  R 28      0          16.02 gtk.css
11:59:13 gnome-screensh 14993  R 3389    0          18.32 gtk-main.css
11:59:25 rs:main Q:Reg  1826   W 156     60         31.85 syslog
11:59:25 pool           15002  R 208     0          14.98 .xsession-errors
11:59:25 pool           15002  R 644     0          12.28 .ICEauthority
11:59:25 pool           15002  R 220     0          13.38 .bash_logout
11:59:27 dconf-service  2599   S 0       0          22.75 user.BHDKOY
11:59:33 compiz         2548   R 4096    0          19.03 firefox.desktop
11:59:34 compiz         15008  R 128     0          27.52 firefox.sh
11:59:34 firefox        15008  R 128     0          36.48 firefox
11:59:34 zeitgeist-daem 2988   S 0       0          62.23 activity.sqlite-wal
11:59:34 zeitgeist-fts  2996   R 8192    40         15.67 postlist.DB
11:59:34 firefox        15008  R 140     0          18.05 dependentlibs.list
11:59:34 zeitgeist-fts  2996   S 0       0          25.96 position.tmp
11:59:34 firefox        15008  R 4096    0          10.67 libplc4.so
11:59:34 zeitgeist-fts  2996   S 0       0          11.29 termlist.tmp
...

Indiki bolsa, biosnoop ulanýanlaryň arasynda proses ID, sektor, baýt, gijä galmak ýaly jikme-jiklikler bilen her sekuntda I/O diskde bir setir çap edeliň.

$ sudo ./biosnoop

TIME(s)        COMM           PID    DISK    T  SECTOR    BYTES   LAT(ms)
0.000000000    ?              0              R  -1        8          0.26
2.047897000    ?              0              R  -1        8          0.21
3.280028000    kworker/u4:0   14871  sda     W  30552896  4096       0.24
3.280271000    jbd2/sda1-8    545    sda     W  29757720  12288      0.40
3.298318000    jbd2/sda1-8    545    sda     W  29757744  4096       0.14
4.096084000    ?              0              R  -1        8          0.27
6.143977000    ?              0              R  -1        8          0.27
8.192006000    ?              0              R  -1        8          0.26
8.303938000    kworker/u4:2   15084  sda     W  12586584  4096       0.14
8.303965000    kworker/u4:2   15084  sda     W  25174736  4096       0.14
10.239961000   ?              0              R  -1        8          0.26
12.292057000   ?              0              R  -1        8          0.20
14.335990000   ?              0              R  -1        8          0.26
16.383798000   ?              0              R  -1        8          0.17
...

Ondan soň, ulgam keşinden her sekuntda jemlenen statistikanyň bir setirini görkezmek üçin kaçestaty ulanmaga dowam edýäris. Bu, pes keş keşini we sypdyrmagyň ýokary tizligini görkezip, ulgam düzmek amallaryna mümkinçilik berýär:

$ sudo ./cachestat

 HITS   MISSES  DIRTIES  READ_HIT% WRITE_HIT%   BUFFERS_MB  CACHED_MB
       0        0        0       0.0%       0.0%           19        544
       4        4        2      25.0%      25.0%           19        544
    1321       33        4      97.3%       2.3%           19        545
    7476        0        2     100.0%       0.0%           19        545
    6228       15        2      99.7%       0.2%           19        545
       0        0        0       0.0%       0.0%           19        545
    7391      253      108      95.3%       2.7%           19        545
   33608     5382       28      86.1%      13.8%           19        567
   25098       37       36      99.7%       0.0%           19        566
   17624      239      416      96.3%       0.5%           19        520
...

Tcpconnect ulanyp, her sekuntda TCP birikmelerine gözegçilik etmek. Onuň çykyşy çeşme we barjak salgy, port belgisini öz içine alýar. Bu gural garaşylmadyk TCP birikmelerini yzarlamak üçin peýdalydyr, şeýlelik bilen programma konfigurasiýalarynda ýa-da hüjümçide netijesizligi ýüze çykarmaga kömek edýär.

$ sudo ./tcpconnect

PID    COMM         IP SADDR            DADDR            DPORT
15272  Socket Threa 4  10.0.2.15        91.189.89.240    80  
15272  Socket Threa 4  10.0.2.15        216.58.199.142   443 
15272  Socket Threa 4  10.0.2.15        216.58.199.142   80  
15272  Socket Threa 4  10.0.2.15        216.58.199.174   443 
15272  Socket Threa 4  10.0.2.15        54.200.62.216    443 
15272  Socket Threa 4  10.0.2.15        54.200.62.216    443 
15272  Socket Threa 4  10.0.2.15        117.18.237.29    80  
15272  Socket Threa 4  10.0.2.15        216.58.199.142   80  
15272  Socket Threa 4  10.0.2.15        216.58.199.131   80  
15272  Socket Threa 4  10.0.2.15        216.58.199.131   443 
15272  Socket Threa 4  10.0.2.15        52.222.135.52    443 
15272  Socket Threa 4  10.0.2.15        216.58.199.131   443 
15272  Socket Threa 4  10.0.2.15        54.200.62.216    443 
15272  Socket Threa 4  10.0.2.15        54.200.62.216    443 
15272  Socket Threa 4  10.0.2.15        216.58.199.132   443 
15272  Socket Threa 4  10.0.2.15        216.58.199.131   443 
15272  Socket Threa 4  10.0.2.15        216.58.199.142   443 
15272  Socket Threa 4  10.0.2.15        54.69.17.198     443 
15272  Socket Threa 4  10.0.2.15        54.69.17.198     443 
...

Aboveokardaky gurallaryň hemmesi dürli gurallar bilen ulanylyp bilner, berlen gural üçin kömek sahypasyny açmak, -h opsiýasyny ulanmak üçin, mysal üçin:

$ sudo ./tcpconnect -h

usage: tcpconnect [-h] [-t] [-p PID] [-P PORT]

Trace TCP connects

optional arguments:
  -h, --help            show this help message and exit
  -t, --timestamp       include timestamp on output
  -p PID, --pid PID     trace this PID only
  -P PORT, --port PORT  comma-separated list of destination ports to trace.

examples:
    ./tcpconnect           # trace all TCP connect()s
    ./tcpconnect -t        # include timestamps
    ./tcpconnect -p 181    # only trace PID 181
    ./tcpconnect -P 80     # only trace port 80
    ./tcpconnect -P 80,81  # only trace port 80 and 81

Şowsuz exec() ulgamlaryny yzarlamak üçin, aşakdaky ýaly opennoop bilen -x opsiýasyny ulanyň:

$ sudo ./opensnoop -x

PID    COMM               FD ERR PATH
15414  pool               -1   2 /home/.hidden
15415  (ostnamed)         -1   2 /sys/fs/cgroup/cpu/system.slice/systemd-hostnamed.service/cgroup.procs
15415  (ostnamed)         -1   2 /sys/fs/cgroup/cpu/system.slice/cgroup.procs
15415  (ostnamed)         -1   2 /sys/fs/cgroup/cpuacct/system.slice/systemd-hostnamed.service/cgroup.procs
15415  (ostnamed)         -1   2 /sys/fs/cgroup/cpuacct/system.slice/cgroup.procs
15415  (ostnamed)         -1   2 /sys/fs/cgroup/blkio/system.slice/systemd-hostnamed.service/cgroup.procs
15415  (ostnamed)         -1   2 /sys/fs/cgroup/blkio/system.slice/cgroup.procs
15415  (ostnamed)         -1   2 /sys/fs/cgroup/memory/system.slice/systemd-hostnamed.service/cgroup.procs
15415  (ostnamed)         -1   2 /sys/fs/cgroup/memory/system.slice/cgroup.procs
15415  (ostnamed)         -1   2 /sys/fs/cgroup/pids/system.slice/systemd-hostnamed.service/cgroup.procs
2548   compiz             -1   2 
15416  systemd-cgroups    -1   2 /run/systemd/container
15416  systemd-cgroups    -1   2 /sys/fs/kdbus/0-system/bus
15415  systemd-hostnam    -1   2 /run/systemd/container
15415  systemd-hostnam    -1  13 /proc/1/environ
15415  systemd-hostnam    -1   2 /sys/fs/kdbus/0-system/bus
1695   dbus-daemon        -1   2 /run/systemd/users/0
15415  systemd-hostnam    -1   2 /etc/machine-info
15414  pool               -1   2 /home/tecmint/.hidden
15414  pool               -1   2 /home/tecmint/Binary/.hidden
2599   dconf-service      -1   2 /run/user/1000/dconf/user
...

Aşakdaky soňky mysal, adaty yz amalyny nädip ýerine ýetirmelidigini görkezýär. PID ulanyp, belli bir prosesi yzarlaýarys.

Ilki bilen amal belgisini kesgitläň:

$ pidof firefox

15437

Soň bolsa, adaty yz buýrugyny işlediň. Aşakdaky buýrukda: -p amal ID-ni kesgitleýär, do_sys_open() ikinji argumentini setir hökmünde dinamiki yzarlaýan ýadro funksiýasydyr.

$ sudo ./trace -p 4095 'do_sys_open "%s", arg2'

TIME     PID    COMM         FUNC             -
12:17:14 15437  firefox      do_sys_open      /run/user/1000/dconf/user
12:17:14 15437  firefox      do_sys_open      /home/tecmint/.config/dconf/user
12:18:07 15437  firefox      do_sys_open      /run/user/1000/dconf/user
12:18:07 15437  firefox      do_sys_open      /home/tecmint/.config/dconf/user
12:18:13 15437  firefox      do_sys_open      /sys/devices/system/cpu/present
12:18:13 15437  firefox      do_sys_open      /dev/urandom
12:18:13 15437  firefox      do_sys_open      /dev/urandom
12:18:14 15437  firefox      do_sys_open      /usr/share/fonts/truetype/liberation/LiberationSans-Italic.ttf
12:18:14 15437  firefox      do_sys_open      /usr/share/fonts/truetype/liberation/LiberationSans-Italic.ttf
12:18:14 15437  firefox      do_sys_open      /usr/share/fonts/truetype/liberation/LiberationSans-Italic.ttf
12:18:14 15437  firefox      do_sys_open      /sys/devices/system/cpu/present
12:18:14 15437  firefox      do_sys_open      /dev/urandom
12:18:14 15437  firefox      do_sys_open      /dev/urandom
12:18:14 15437  firefox      do_sys_open      /dev/urandom
12:18:14 15437  firefox      do_sys_open      /dev/urandom
12:18:15 15437  firefox      do_sys_open      /sys/devices/system/cpu/present
12:18:15 15437  firefox      do_sys_open      /dev/urandom
12:18:15 15437  firefox      do_sys_open      /dev/urandom
12:18:15 15437  firefox      do_sys_open      /sys/devices/system/cpu/present
12:18:15 15437  firefox      do_sys_open      /dev/urandom
12:18:15 15437  firefox      do_sys_open      /dev/urandom
....

Gysgaça mazmun

BCC ulgamyň işleýşine gözegçilik etmek, blok enjamynyň I/O yzarlamak, TCP funksiýalary, faýl ulgamy amallary, syscalls, Node.js zondlary we başga-da köp ulgam dolandyryş meseleleri üçin güýçli we ulanmak üçin aňsat gurallar toplumy. Möhümi, ulanyjylara dostlukly we ygtybarly etmek üçin size ýol görkezmek üçin gurallar üçin birnäçe mysal faýllary we adam sahypalary bilen iberilýär.

Iň soňkusy, bu hakda pikirleriňizi paýlaşyp, soraglar berip bilersiňiz, aşakdaky teswirler bölüminiň üsti bilen peýdaly teklipler ýa-da islendik konstruktiw jogap berip bilersiňiz.

Has giňişleýin maglumat we ulanylyş üçin: https://iovisor.github.io/bcc/