biosnoop(8) System Manager's Manual biosnoop(8)

# [NAME](#NAME)

biosnoop - Trace block device I/O and print details incl. issuing PID.

# [SYNOPSIS](#SYNOPSIS)

**biosnoop \[-h] \[-Q] \[-d DISK] \[-P]**

# [DESCRIPTION](#DESCRIPTION)

This tools traces block device I/O (disk I/O), and prints a one-line summary for each I/O showing various details. These include the latency from the time of issue to the device to its completion, and the PID and process name from when the I/O was first created (which usually identifies the responsible process).

This uses in-kernel eBPF maps to cache process details (PID and comm) by I/O request, as well as a starting timestamp for calculating I/O latency.

This works by tracing various kernel blk\_\*() functions using dynamic tracing, and will need updating to match any changes to these functions.

This makes use of a Linux 4.4 feature (bpf\_perf\_event\_output()); for kernels older than 4.4, see the version under tools/old, which uses an older mechanism

Since this uses BPF, only the root user can use this tool.

# [REQUIREMENTS](#REQUIREMENTS)

CONFIG\_BPF and bcc.

# [OPTIONS](#OPTIONS)

[-h](#h)

Print usage message.

[-Q](#Q)

Include a column showing the time spent queued in the OS.

[-d DISK](#d)

Trace this disk only.

[-P](#P)

Display block I/O pattern (sequential or random).

# [EXAMPLES](#EXAMPLES)

[Trace all block device I/O and print a summary line per I/O:](#Trace)

\# **biosnoop**

# [FIELDS](#FIELDS)

[TIME(s)](#TIME%28s%29)

Time of the I/O completion, in seconds since the first I/O was seen.

[COMM](#COMM)

Cached process name, if present. This usually (but isn't guaranteed) to identify the responsible process for the I/O.

[PID](#PID)

Cached process ID, if present. This usually (but isn't guaranteed) to identify the responsible process for the I/O.

[DISK](#DISK)

Disk device name.

[T](#T)

Type of I/O: R = read, W = write. This is a simplification.

[SECTOR](#SECTOR)

Device sector for the I/O.

[BYTES](#BYTES)

Size of the I/O, in bytes.

[QUE(ms)](#QUE%28ms%29)

Time the I/O was queued in the OS before being issued to the device, in milliseconds.

[LAT(ms)](#LAT%28ms%29)

Time for the I/O (latency) from the issue to the device, to its completion, in milliseconds.

# [OVERHEAD](#OVERHEAD)

Since block device I/O usually has a relatively low frequency (< 10,000/s), the overhead for this tool is expected to be negligible. For high IOPS storage systems, test and quantify before use.

# [SOURCE](#SOURCE)

This is from bcc.

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

# [OS](#OS)

Linux

# [STABILITY](#STABILITY)

Unstable - in development.

# [AUTHOR](#AUTHOR)

Brendan Gregg, Rocky Xing

# [SEE ALSO](#SEE_ALSO)

[disksnoop(8)](/man/enterprise-packages/bcc/disksnoop.8), [iostat(1)](/man/enterprise-packages/bcc/iostat.1)

2015-09-16 USER COMMANDS

---

Document: biosnoop(8) from bcc 0.37.0-r2 (Chainguard OS)
Source: https://github.com/iovisor/bcc