https://github.com/rinhizakura/ebpf-strace
A demonstration to show how to trace syscalls by eBPF
https://github.com/rinhizakura/ebpf-strace
ebpf linux strace syscalls
Last synced: 25 days ago
JSON representation
A demonstration to show how to trace syscalls by eBPF
- Host: GitHub
- URL: https://github.com/rinhizakura/ebpf-strace
- Owner: RinHizakura
- Created: 2023-03-27T10:02:15.000Z (about 2 years ago)
- Default Branch: main
- Last Pushed: 2024-10-16T17:07:19.000Z (7 months ago)
- Last Synced: 2024-10-19T09:51:41.478Z (7 months ago)
- Topics: ebpf, linux, strace, syscalls
- Language: C
- Homepage:
- Size: 822 KB
- Stars: 4
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# ebpf-strace
## Overview
The `ebpf-strace` is an experimental tool to trace system calls like
[strace](https://github.com/strace/strace), but achieving by
[eBPF](https://en.wikipedia.org/wiki/EBPF) instead of
[ptrace](https://man7.org/linux/man-pages/man2/ptrace.2.html).
The tool can be run on x86_64 or aarch64, but most of the
validation only done on x86_64 currently. Besides, only a few syscalls's
arguments can be traced. Please feel free to report for any unusual output
or implement arguments tracing for more system calls.
## Usage
### Build
These dependencies are required to build ebpf-strace.
```
$ sudo apt install clang llvm libelf1 libelf-dev zlib1g-dev
```
You will also need `bpftool` for the generating of `vmlinux.h`.
```
$ git clone https://github.com/libbpf/bpftool.git
$ cd bpftool
$ git submodule update --init
$ cd src
$ make
$ sudo make install
```
After the installations, you can build `ebpf-strace` now.
```
$ make
```
### Execute
To know the detail for how to use ebpf-strace, you can try `-h` for the direction.
```
$ sudo ./ebpf -h
Usage: ebpf-strace [OPTIONS] [CMD]...
Arguments:
[CMD]... command to run for trace
Options:
-T, --syscall-times whether to show on the time cost of syscall
-h, --help Print help
```
For example, we can trace which system calls are run during the execution
of `echo hello` with the following command:
```
$ sudo ./ebpf-strace echo hello
```