安装bcc-tools并简单运用biosnoop

安装bcc-tools1. g++、git和cmake等基础工具包2. 安装llvm和clang两种方式：第一种方式，直接apt安装sudo apt-get install llvmsudo apt-get install clang第二种方式，源码编译（本人编译到一半由于报错等问题放弃了这种方法）wget http://releases.llvm.org/4.0.0/llvm-4.0.0.src

L_jessica7227

1601人浏览 · 2021-10-20 11:01:34

L_jessica7227 · 2021-10-20 11:01:34 发布

安装bcc-tools

1. g++、git和cmake等基础工具包
2. 安装llvm和clang
两种方式：

第一种方式，直接apt安装

sudo apt-get install llvm
sudo apt-get install clang

第二种方式，源码编译（本人编译到一半由于报错等问题放弃了这种方法）

wget http://releases.llvm.org/4.0.0/llvm-4.0.0.src.tar.xz
tar -xf llvm-4.0.0.src.tar.xz
wget http://releases.llvm.org/4.0.0/cfe-4.0.0.src.tar.xz
tar -xf cfe-4.0.0.src.tar.xz
mv cfe-4.0.0.src llvm-4.0.0.src/tools/
mkdir llvm-build&cd llvm-build
cmake ../llvm-4.0.0.src -DLLVM_TARGETS_TO_BUILD=X86 -DCMAKE_BUILD_TYPE=Release -DLLVM_USE_LINKER=gold
make
make install

补充方法 也可以用官网的方式下载依赖，这样依赖包会很齐全
官网上下载依赖命令如下

# Trusty (14.04 LTS) and older
VER=trusty
echo "deb http://llvm.org/apt/$VER/ llvm-toolchain-$VER-3.7 main
deb-src http://llvm.org/apt/$VER/ llvm-toolchain-$VER-3.7 main" | \
  sudo tee /etc/apt/sources.list.d/llvm.list
wget -O - http://llvm.org/apt/llvm-snapshot.gpg.key | sudo apt-key add -
sudo apt-get update

# For Bionic (18.04 LTS)
sudo apt-get -y install bison build-essential cmake flex git libedit-dev \
  libllvm6.0 llvm-6.0-dev libclang-6.0-dev python zlib1g-dev libelf-dev libfl-dev python3-distutils

# For Eoan (19.10) or Focal (20.04.1 LTS)
sudo apt install -y bison build-essential cmake flex git libedit-dev \
  libllvm7 llvm-7-dev libclang-7-dev python zlib1g-dev libelf-dev libfl-dev python3-distutils

# For other versions
sudo apt-get -y install bison build-essential cmake flex git libedit-dev \
  libllvm3.7 llvm-3.7-dev libclang-3.7-dev python zlib1g-dev libelf-dev python3-distutils

# For Lua support
sudo apt-get -y install luajit luajit-5.1-dev

3. 下载安装bcc

git clone https://github.com/iovisor/bcc.git
mkdir bcc/build; cd bcc/build
cmake ..
make
sudo make install
cmake -DPYTHON_CMD=python3 .. # build python3 binding
pushd src/python/
make
sudo make install
popd

结束~~可以用bcc工具啦

使用bcctools

进入bcc文件下面的tools文件（bcc/tools）
运行

sudo ./biosnoop.py

或者运行别的工具也可以（其实目前还没搞懂这些工具的具体内容）

“售后问题”

安装结束之后，运行biosnoop，出现错误如下
（我之前运行的时候也遇到过这个错误，当时还改了源代码，当时这次仔细阅读报错信息后发现是我没有加权限导致的，记在这里提醒一下大家，还是要仔细看报错信息！）

llxy@llxy-GS65-Stealth-9SD:~/bcc/tools$ ./biosnoop.py 
bpf: Failed to load program: Operation not permitted

Traceback (most recent call last):
  File "./biosnoop.py", line 166, in <module>
    b.attach_kprobe(event="blk_account_io_start", fn_name="trace_pid_start")
  File "/usr/lib/python2.7/dist-packages/bcc/__init__.py", line 829, in attach_kprobe
    fn = self.load_func(fn_name, BPF.KPROBE)
  File "/usr/lib/python2.7/dist-packages/bcc/__init__.py", line 524, in load_func
    raise Exception("Need super-user privileges to run")
Exception: Need super-user privileges to run

试试加上sudo权限

llxy@llxy-GS65-Stealth-9SD:~/bcc/tools$ sudo ./biosnoop.py 
[sudo] llxy 的密码： 
TIME(s)     COMM           PID    DISK    T SECTOR     BYTES  LAT(ms)
0.000000    jbd2/nvme0n1p1 796    nvme0n1 W 428651136  45056     0.98
0.001253    ?              0              R 0          0         1.16
0.002113    jbd2/nvme0n1p1 796    nvme0n1 W 428651224  4096      0.81
0.001357    biosnoop.py    130105 nvme0n1 R 929313032  4096      0.48
0.002580    biosnoop.py    130105 nvme0n1 R 926799600  20480     0.25
2.047981    jbd2/nvme0n1p9 289    nvme0n1 W 937820040  24576     0.95
2.048823    ?              0              R 0          0         0.78
2.049707    jbd2/nvme0n1p9 289    nvme0n1 W 937820088  4096      0.83
4.863983    kworker/u24:1  129937 nvme0n1 W 933345328  4096      0.94
4.863995    kworker/u24:1  129937 nvme0n1 W 933345368  4096      0.95
4.863998    kworker/u24:1  129937 nvme0n1 W 933345432  4096      0.95
4.864001    kworker/u24:1  129937 nvme0n1 W 933345464  4096      0.95
4.864004    kworker/u24:1  129937 nvme0n1 W 933345544  4096      0.96
4.864007    kworker/u24:1  129937 nvme0n1 W 933345576  4096      0.96
4.864010    kworker/u24:1  129937 nvme0n1 W 933345672  4096      0.96
4.864013    kworker/u24:1  129937 nvme0n1 W 933345728  4096      0.96
4.864179    kworker/u24:1  129937 nvme0n1 W 933345856  4096      0.09
4.864185    kworker/u24:1  129937 nvme0n1 W 933346152  4096      0.09
4.864188    kworker/u24:1  129937 nvme0n1 W 933346240  4096      0.09
4.864191    kworker/u24:1  129937 nvme0n1 W 933346440  4096      0.09
4.864196    kworker/u24:1  129937 nvme0n1 W 933346464  8192      0.09
4.864199    kworker/u24:1  129937 nvme0n1 W 933346872  4096      0.10
...
...