eBPF - 例子 进程在 CPU 的运行时间

probe 点: tracepoint:sched:sched_switch
查看参数:

supra@suprabox:~/work/ebpf/bpftrace$ sudo bpftrace -lv tracepoint:sched:sched_switch
tracepoint:sched:sched_switch
    char prev_comm[16]
    pid_t prev_pid
    int prev_prio
    long prev_state
    char next_comm[16]
    pid_t next_pid
    int next_prio

代码如下:

BEGIN
{
    printf("     usecs         count |      distribution                                  |");
}

tracepoint:sched:sched_switch { 
    $prev = args.prev_pid;
    if (@pid[$prev]) {
        @ns = hist((nsecs - @pid[$prev])/1000);
        delete(@pid[$prev]);
    }
    @pid[args.next_pid] = nsecs;
}

END
{
    clear(@pid);
}