spycat
An eBPF observable agent to solve os performance issue in kernel or app like bcc tool.
These tools developed refer to bcc which are really useful for solving os issue and some
new feature added.
- support more kernel version
- support data store with third-party database
- ...
Components
Feature List
cpu subsystem
-
oncpu
continus profiling to detect cpu burst issue, data can be stored in pyroscope
-
offcpu
detect task scheduling not timely issue, like web app timeout etc.
-
futexsnoop
detect multitasking lock contention issue
mem subsystem
io subsystem
net subsystem
Exporter List
- tmerminal
- local storage
- loki
- pyroscope
- influxdb
- prometheus
Quick Start
How to build
You can use docker/build.sh to build in a container.
usage: ./args.sh [-h|--help -b|--build -c|--compile -t|--tar -V|--bin_ver]
-b build image
-c compile
-t tar binary
-V 0.1.2 -t tar binary with 0.1.2 version
How to run
tool list help
SUBCOMMANDS
completion generate the autocompletion script for the specified shell
futexsnoop eBPF snoop user futex
help Help about any command
offcpu eBPF offcpu profiler
oncpu eBPF oncpu sampling profiler
version Print spycat version details
FLAGS DEFAULT VALUES
--help false
help for spycat
--version false
Run 'Spycat SUBCOMMAND --help' for more information on a subcommand.
futexsnoop for example
sudo ./spycat futexsnoop -h
FLAGS DEFAULT VALUES
--app-name
application name used when uploading profiling data
--help false
help for futexsnoop
--log-level info
log level: debug|info|warn|error
--max-dur-ms 1000000
max time(ms) wait unlock
--max-lock-hold-users 100
max users hold the same lock
--min-dur-ms 1000
min time(ms) wait unlock
--pid 0
pid to trace, -1 to trace all pids
--stack false
get stack info or not
--symbol-cache-size 256
max size of symbols cache
--target-lock 0
target lock addr
--tid 0
tid to trace, -1 to trace all tids
How to develop
License
spycat is distributed under [Apache License, Version2.0]
Thanks
- Kindling Pyroscope libbpf bcc
- ...