5.18 BCC工具之bpflist.py解读

一，工具简介

bpflist工具显示当前正在使用BPF程序和映射的进程、pinned的BPF程序和映射以及已使能探针的进程。也就是说bpflist可以为我们展示出系统哪个BPF程序在运行，并打印相关的探针。

二，代码示例

#!/usr/bin/env python

from bcc import BPF, USDT
import argparse
import re
import os
import subprocess

examples = """examples:
    bpflist     # display all processes currently using BPF
    bpflist -v  # also count kprobes/uprobes
    bpflist -vv # display kprobes/uprobes and count them
"""
parser = argparse.ArgumentParser(
    description="Display processes currently using BPF programs and maps",
    formatter_class=argparse.RawDescriptionHelpFormatter,
    epilog=examples)
parser.add_argument("-v", "--verbosity", action="count", default=0,
    help="count and display kprobes/uprobes as well")
args = parser.parse_args()

def comm_for_pid(pid):
    try:
        return open("/proc/%d/comm" % pid).r