{"id":13645599,"url":"https://github.com/kinvolk/traceloop","last_synced_at":"2025-04-21T14:31:51.724Z","repository":{"id":38456678,"uuid":"181040994","full_name":"kinvolk/traceloop","owner":"kinvolk","description":" Now moved into `github.com/inspektor-gadget/inspektor-gadget/pkg/gadget-collection/gadgets/traceloop`. Tracing system calls in cgroups using BPF and overwritable ring buffers","archived":true,"fork":false,"pushed_at":"2023-03-29T19:29:03.000Z","size":561,"stargazers_count":195,"open_issues_count":14,"forks_count":11,"subscribers_count":20,"default_branch":"main","last_synced_at":"2024-08-02T01:25:32.831Z","etag":null,"topics":["bpf","cgroup","inspektor-gadget","kinvolk"],"latest_commit_sha":null,"homepage":"https://github.com/inspektor-gadget/inspektor-gadget","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kinvolk.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2019-04-12T16:03:15.000Z","updated_at":"2024-07-22T00:35:48.000Z","dependencies_parsed_at":"2024-01-14T10:01:05.490Z","dependency_job_id":null,"html_url":"https://github.com/kinvolk/traceloop","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kinvolk%2Ftraceloop","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kinvolk%2Ftraceloop/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kinvolk%2Ftraceloop/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kinvolk%2Ftraceloop/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kinvolk","download_url":"https://codeload.github.com/kinvolk/traceloop/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":223868411,"owners_count":17217085,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bpf","cgroup","inspektor-gadget","kinvolk"],"created_at":"2024-08-02T01:02:38.158Z","updated_at":"2024-11-09T18:31:53.596Z","avatar_url":"https://github.com/kinvolk.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":"# traceloop\n\ntraceloop is a command line tool to trace system calls in a similar way to\nstrace but with some differences:\n- traceloop uses BPF instead of ptrace\n- traceloop's tracing granularity is the control group (cgroup) instead of a\n  process\n- traceloop's traces are recorded in a fast, in-memory, overwritable ring\n  buffer like a flight recorder. The tracing could be permanently enabled and\n  inspected in case of crash.\n\ntraceloop can be used directly on the command line or via an HTTP interface.\n\ntraceloop has been written to trace Kubernetes Pods with [Inspektor\nGadget](https://github.com/kinvolk/inspektor-gadget), but it can as easily be\nused with systemd services that are in their own control groups (look for\n`.service` and `.scope` directories inside `/sys/fs/cgroup/unified/`).\n\n## On the command line\n\nExample with an existing systemd service:\n```\nsudo -E ./traceloop cgroups /sys/fs/cgroup/unified/system.slice/sshd.service\n```\n\nExample with a custom command:\n```\nsudo systemd-run -t  --unit=test42.service  /bin/sh -c 'for i in $(seq 1 1000) ; do sleep 4 ; echo 2*3*7 | bc \u003e /dev/null ; echo Multiplication $i done. ; done'\n...\nsudo -E ./traceloop cgroups /sys/fs/cgroup/unified/system.slice/test42.service\n...\n00:04.022260640 cpu#0 pid 23981 [bc] brk(brk=0) = 94045092683776\n00:04.022346588 cpu#0 pid 23981 [bc] ioctl(fd=0, cmd=21505, arg=140721805741680) = 18446744073709551591\n00:04.022361201 cpu#0 pid 23981 [bc] read(fd=0, buf=94045092586128 \"2*3*7\\n\", count=8192) = 6\n00:04.022401517 cpu#0 pid 23981 [bc] fstat() = 0\n00:04.022414650 cpu#0 pid 23981 [bc] ioctl(fd=1, cmd=21505, arg=140721805741312) = 18446744073709551591\n00:04.022440173 cpu#0 pid 23981 [bc] write(fd=1, buf=94045092602832 \"42\\n\", count=3) = 3\n00:04.022460351 cpu#0 pid 23981 [bc] read(fd=0, buf=94045092586128 \"\", count=8192) = 0\n00:04.022475888 cpu#0 pid 23981 [bc] ioctl(fd=0, cmd=21505, arg=140721805741616) = 18446744073709551591\n00:04.022525326 cpu#0 pid 23981 [bc] exit_group(error_code=0)...\n00:04.022833827 cpu#2 pid 23961 [sh] ...wait4() = 23981\n```\n\n\n## With Docker\n\n```\ndocker run --rm -v /sys/kernel/debug:/sys/kernel/debug -v /sys/fs/cgroup:/sys/fs/cgroup -v /sys/fs/bpf:/sys/fs/bpf -v /run:/run --privileged kinvolk/traceloop\n```\n\n## With HTTP interface\n\n```\nsudo -E ./traceloop serve\n...\n\n$ sudo curl --unix-socket /run/traceloop.socket 'http://localhost/add?name=sshd\u0026cgrouppath=/sys/fs/cgroup/unified/system.slice/sshd.service'\nadded as id 0\n$ sudo curl --unix-socket /run/traceloop.socket 'http://localhost/list'\n0: [sshd] /sys/fs/cgroup/unified/system.slice/sshd.service\n$ sudo curl --unix-socket /run/traceloop.socket 'http://localhost/dump-by-cgroup?cgroup=/sys/fs/cgroup/unified/system.slice/sshd.service'\n...\n\n```\n\n### Talk at Linux Plumbers Conference 2020\n\nA comprehensive presentation was held at LPC 2020 in the Networking and BPF Summit.\nSee the slides [here](https://linuxplumbersconf.org/event/7/contributions/667/attachments/510/919/Traceloop_and_BPF_Linux_Plumbers_Conference_-_LPC_2020.pdf).\n\nAfter feedback to include a comparison to `perf trace` we reran the benchmark but omitted the synchronous write syscall case that logs the buffer contents because dumping the buffers is not implemented in `perf trace`. Here the results:\n\n![benchmark graph](contrib/graph-2020-08-25.png)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkinvolk%2Ftraceloop","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkinvolk%2Ftraceloop","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkinvolk%2Ftraceloop/lists"}