kloczek

Just FTR. Your example is wrong.

[root@domek ~]# /usr/share/bcc/tools/funclatency -i 10 -p `pgrep -n mysqld` sys_write 0 functions matched by "sys_write". Exiting.

The correct one is:

funclatency -i 10 -p `pgrep -n mysqld` vfs_write

Nevertheless, I'm not happy that there this no in this case analogue of the language which I can use on correlating data from different probes. Tools like funclatency cover exact class of the cases and on implementing anything more sophisticated still, I wont to have something like DTrace as frontend.

Better? OK, could you please show me eBPF oneliner code which is analogue of the DTrace command like:

# dtrace -qn 'syscall::write:entry /execname == "mysqld"/ {self->stime = timestamp;} syscall::write:return /self->stime != 0/ {@LWrite = quantize(timestamp - self->stime);} tick-10s {printa(@LWrite);}'

??

Above is now working not only under Solaris but under Oracle UEK Linux kernel as well.