iovisor / iovisor/bcc

ucalls -S option does not work with newer kernels

Open
#2,052 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

When experimenting with ucalls I discovered the -S (--syscalls) option does not work with newer Linux kernels. The code has a regular expression to find the functions to instrument:

syscall_regex = "^[Ss]y[Ss]_.*"

This is not going to match the syscall function names for newer kernels. Wouldn't it be more efficient to implement the syscall instrumentation using the raw_syscalls:sys_enter and raw_syscalls:sys_exit tracepoints and map the syscall number like syscount.py does?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the ucalls implementation for the -S/--syscalls option and compare it with syscount.py, especially how syscall numbers are mapped. Check the existing syscall regex and tracepoint-related paths, then verify that syscall instrumentation works on newer Linux kernels using raw_syscalls:sys_enter and raw_syscalls:sys_exit.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux, python
Domain
observability-sre, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.