drsnoop(8) System Manager's Manual drsnoop(8)

# [NAME](#NAME)

drsnoop - Trace direct reclaim events. Uses Linux eBPF/bcc.

# [SYNOPSIS](#SYNOPSIS)

**drsnoop \[-h] \[-T] \[-U] \[-p PID] \[-t TID] \[-u UID] \[-d DURATION] \[-n name] \[-v]**

# [DESCRIPTION](#DESCRIPTION)

drsnoop trace direct reclaim events, showing which processes are allocing pages with direct reclaiming. This can be useful for discovering when allocstall (/p- roc/vmstat) continues to increase, whether it is caused by some critical proc- esses or not.

This works by tracing the direct reclaim events using kernel tracepoints.

This makes use of a Linux 4.4 feature (bpf\_perf\_event\_output()); for kernels older than 4.4, see the version under tools/old, which uses an older mechanism.

Since this uses BPF, only the root user can use this tool.

# [REQUIREMENTS](#REQUIREMENTS)

CONFIG\_BPF and bcc.

# [OPTIONS](#OPTIONS)

[-h](#h)

Print usage message.

[-T](#T)

Include a timestamp column.

[-U](#U)

Show UID.

[-p PID](#p)

Trace this process ID only (filtered in-kernel).

[-t TID](#t)

Trace this thread ID only (filtered in-kernel).

[-u UID](#u)

Trace this UID only (filtered in-kernel).

[-d DURATION](#d)

Total duration of trace in seconds.

[-n name](#n)

Only print processes where its name partially matches 'name' -v verbose Run in verbose mode. Will output system memory state

[-v](#v)

show system memory state

# [EXAMPLES](#EXAMPLES)

[Trace all direct reclaim events:](#Trace)

\# **drsnoop**

[Trace all direct reclaim events, for 10 seconds only:](#Trace~2)

\# **drsnoop -d 10**

[Trace all direct reclaim events, and include timestamps:](#Trace~3)

\# **drsnoop -T**

[Show UID:](#Show)

\# **drsnoop -U**

[Trace PID 181 only:](#Trace~4)

\# **drsnoop -p 181**

[Trace UID 1000 only:](#Trace~5)

\# **drsnoop -u 1000**

[Trace all direct reclaim events from processes where its name partially match-](#Trace~6)

es 'mond': # **drnsnoop -n mond**

# [FIELDS](#FIELDS)

[TIME(s)](#TIME%28s%29)

Time of the call, in seconds.

[UID](#UID)

User ID

[PID](#PID)

Process ID

[TID](#TID)

Thread ID

[COMM](#COMM)

Process name

# [OVERHEAD](#OVERHEAD)

This traces the kernel direct reclaim tracepoints and prints output for each event. As the rate of this is generally expected to be low (< 1000/s), the overhead is also expected to be negligible.

# [SOURCE](#SOURCE)

This is from bcc.

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

# [OS](#OS)

Linux

# [STABILITY](#STABILITY)

Unstable - in development.

# [AUTHOR](#AUTHOR)

Wenbo Zhang

2019-02-20 USER COMMANDS

---

Document: drsnoop(8) from bcc 0.37.0-r3 (Chainguard OS)
Source: https://github.com/iovisor/bcc