4 ms·

What is the main advantage of this over native strace?

wmf 5y ago
strace only traces system calls while bpftrace does much more. Just looking at the first example, vfs_read isn't a system call (read() may also operate on sockets or whatever) and strace doesn't calculate histograms AFAIK.
- tych0 5y ago
  I use it a lot to figure out why things fail. For example, what if you get an -EPERM from mount()? Was it denied by seccomp, an LSM, because you don't own the user namespace that owns your mount namespace? strace will tell you it failed, but bpftrace can help understand why. Note that I said "help": bpftrace can tell you "this function failed with EPERM", but e.g. ovl_fill_super() can fill with EPERM for lots of different reasons. So it's a bit like printf debugging. And you're SOL if the error is generated within that function or from an inlined function :(
yakubin 5y ago
bpftrace has lower overhead, because, thanks to BPF, it can accumulate all the data needed in kernel and only send a summary to userspace to be displayed. strace on the other hand uses the ptrace(2) syscall to set a breakpoint on each syscall, including the ones that you do not trace (when you filter calls e.g.) and on each syscall data travels between kernel and strace. It's possible that in the future strace will use BPF as well to lower its overhead. bpftrace is also more versatile. You could use it to e.g. collect stack traces for all the syscalls a program makes. You can also attach actions to more things than just syscalls. You can e.g. use kprobes to inject code into kernel functions which aren't exported as syscalls.
1vuio0pswjnm7 5y ago
bpftrace requires about 318 MB to install strace requires less than 2 MB Bigger is better :)
- Sevan777 5y ago
  Standalone binary the project publishes is 45MB. https://github.com/iovisor/bpftrace/releases/download/v0.13.0/bpftrace https://github.com/iovisor/bpftrace/releases/download/v0.13....
  - PennRobotics 5y ago
    I just tried two commands. apt install bpftrace: needs 1,201 kB apt remove strace: frees 1,792 kB
    - 1vuio0pswjnm7 5y ago
      Need to look at the bpftrace dependencies For example, is clang already installed
  - 1vuio0pswjnm7 5y ago
    How large is strace standalone binary 45MB is still huge; its not even statically-linked The largest programs I use, even when statically-linked against musl are all under 6MB
    - 1vuio0pswjnm7 5y ago
      And I can count on one hand the number of programs I use that are over 1MB
- deleted 5y ago
  [deleted]

wmf 5y ago

strace only traces system calls while bpftrace does much more. Just looking at the first example, vfs_read isn't a system call (read() may also operate on sockets or whatever) and strace doesn't calculate histograms AFAIK.

tych0 5y ago
I use it a lot to figure out why things fail. For example, what if you get an -EPERM from mount()? Was it denied by seccomp, an LSM, because you don't own the user namespace that owns your mount namespace? strace will tell you it failed, but bpftrace can help understand why. Note that I said "help": bpftrace can tell you "this function failed with EPERM", but e.g. ovl_fill_super() can fill with EPERM for lots of different reasons. So it's a bit like printf debugging. And you're SOL if the error is generated within that function or from an inlined function :(

yakubin 5y ago

bpftrace has lower overhead, because, thanks to BPF, it can accumulate all the data needed in kernel and only send a summary to userspace to be displayed. strace on the other hand uses the ptrace(2) syscall to set a breakpoint on each syscall, including the ones that you do not trace (when you filter calls e.g.) and on each syscall data travels between kernel and strace. It's possible that in the future strace will use BPF as well to lower its overhead. bpftrace is also more versatile. You could use it to e.g. collect stack traces for all the syscalls a program makes. You can also attach actions to more things than just syscalls. You can e.g. use kprobes to inject code into kernel functions which aren't exported as syscalls.

1vuio0pswjnm7 5y ago

bpftrace requires about 318 MB to install strace requires less than 2 MB Bigger is better :)

Sevan777 5y ago
Standalone binary the project publishes is 45MB. https://github.com/iovisor/bpftrace/releases/download/v0.13.0/bpftrace https://github.com/iovisor/bpftrace/releases/download/v0.13....
- PennRobotics 5y ago
  I just tried two commands. apt install bpftrace: needs 1,201 kB apt remove strace: frees 1,792 kB
  - 1vuio0pswjnm7 5y ago
    Need to look at the bpftrace dependencies For example, is clang already installed
- 1vuio0pswjnm7 5y ago
  How large is strace standalone binary 45MB is still huge; its not even statically-linked The largest programs I use, even when statically-linked against musl are all under 6MB
  - 1vuio0pswjnm7 5y ago
    And I can count on one hand the number of programs I use that are over 1MB
deleted 5y ago
[deleted]