brief introduction

BPF Compiler collection （BPF Compiler Collection, abbreviation BCC）. Project address https://github.com/iovisor/bcc, Is a toolkit for creating efficient kernel tracing and operating programs , Includes several useful tools and examples . It takes advantage of the extended BPF（ Berkeley bag filter ）, The official name is eBPF.
BCC send BPF The program is easier to write , Use C Kernel tools in （ And includes surrounding LLVM Of C Wrappers ）, as well as Python and lua The front end of . It applies to many tasks , Including performance analysis and network traffic control .
BCC It also contains several that can be used directly BPF Performance analysis and fault location tools .

BCC structure

BCCde Directory structure as shown

# ls
CMakeLists.txt           FAQ.txt      LINKS.md       SPECS   docker    images         man      src
CODEOWNERS               INSTALL.md   QUICKSTART.md  cmake   docs      introspection  scripts  tests
CONTRIBUTING-SCRIPTS.md  LICENSE.txt  README.md      debian  examples  libbpf-tools   snap     tools

• tools： contain BCC Tools and examples provided .
• man： Help documents containing tools .
• src： contain Python、C++、Lua Of BCC library

install BCC

Kernel requirements

BCC It is recommended to use the latest kernel , And the kernel needs to turn on the option

• CONFIG_BPF=y
• CONFIG_BPF_SYSCALL=y
• CONFIG_BPF_EVENTS=y
• CONFIG_BPF_JIT=y
• CONFIG_HAVE_EBPF_JIT=y

Ubuntu

BCC Has been packaged to Ubuntu In the warehouse , Package name is bpfcc-tools, You can directly use the command to install

apt-get install bpfcc-tools linux-headers-$(uname -r)

After execution BCC The tool will be installed in /sbin Under the table of contents , with -bpfcc suffix

ls /sbin/*-bpfcc
/sbin/argdist-bpfcc       /sbin/fileslower-bpfcc      /sbin/perlcalls-bpfcc    /sbin/syncsnoop-bpfcc
/sbin/bashreadline-bpfcc  /sbin/filetop-bpfcc         /sbin/perlflow-bpfcc     /sbin/syscount-bpfcc
/sbin/bindsnoop-bpfcc     /sbin/funccount-bpfcc       /sbin/perlstat-bpfcc     /sbin/tclcalls-bpfcc
/sbin/biolatency-bpfcc    /sbin/funcinterval-bpfcc    /sbin/phpcalls-bpfcc     /sbin/tclflow-bpfcc
/sbin/biolatpcts-bpfcc    /sbin/funclatency-bpfcc     /sbin/phpflow-bpfcc      /sbin/tclobjnew-bpfcc
/sbin/biosnoop-bpfcc      /sbin/funcslower-bpfcc      /sbin/phpstat-bpfcc      /sbin/tclstat-bpfcc
/sbin/biotop-bpfcc        /sbin/gethostlatency-bpfcc  /sbin/pidpersec-bpfcc    /sbin/tcpaccept-bpfcc
/sbin/bitesize-bpfcc      /sbin/hardirqs-bpfcc        /sbin/profile-bpfcc      /sbin/tcpconnect-bpfcc
/sbin/bpflist-bpfcc       /sbin/inject-bpfcc          /sbin/pythoncalls-bpfcc  /sbin/tcpconnlat-bpfcc
/sbin/btrfsdist-bpfcc     /sbin/javacalls-bpfcc       /sbin/pythonflow-bpfcc   /sbin/tcpdrop-bpfcc
/sbin/btrfsslower-bpfcc   /sbin/javaflow-bpfcc        /sbin/pythongc-bpfcc     /sbin/tcplife-bpfcc
/sbin/cachestat-bpfcc     /sbin/javagc-bpfcc          /sbin/pythonstat-bpfcc   /sbin/tcpretrans-bpfcc
/sbin/cachetop-bpfcc      /sbin/javaobjnew-bpfcc      /sbin/readahead-bpfcc    /sbin/tcprtt-bpfcc
/sbin/capable-bpfcc       /sbin/javastat-bpfcc        /sbin/reset-trace-bpfcc  /sbin/tcpstates-bpfcc
/sbin/cobjnew-bpfcc       /sbin/javathreads-bpfcc     /sbin/rubycalls-bpfcc    /sbin/tcpsubnet-bpfcc
/sbin/compactsnoop-bpfcc  /sbin/killsnoop-bpfcc       /sbin/rubyflow-bpfcc     /sbin/tcpsynbl-bpfcc
/sbin/cpudist-bpfcc       /sbin/klockstat-bpfcc       /sbin/rubygc-bpfcc       /sbin/tcptop-bpfcc
/sbin/cpuunclaimed-bpfcc  /sbin/llcstat-bpfcc         /sbin/rubyobjnew-bpfcc   /sbin/tcptracer-bpfcc
/sbin/criticalstat-bpfcc  /sbin/mdflush-bpfcc         /sbin/rubystat-bpfcc     /sbin/threadsnoop-bpfcc
/sbin/dbslower-bpfcc      /sbin/memleak-bpfcc         /sbin/runqlat-bpfcc      /sbin/tplist-bpfcc
/sbin/dbstat-bpfcc        /sbin/mountsnoop-bpfcc      /sbin/runqlen-bpfcc      /sbin/trace-bpfcc
/sbin/dcsnoop-bpfcc       /sbin/mysqld_qslower-bpfcc  /sbin/runqslower-bpfcc   /sbin/ttysnoop-bpfcc
/sbin/dcstat-bpfcc        /sbin/netqtop-bpfcc         /sbin/shmsnoop-bpfcc     /sbin/vfscount-bpfcc
/sbin/deadlock-bpfcc      /sbin/nfsdist-bpfcc         /sbin/slabratetop-bpfcc  /sbin/vfsstat-bpfcc
/sbin/dirtop-bpfcc        /sbin/nfsslower-bpfcc       /sbin/sofdsnoop-bpfcc    /sbin/wakeuptime-bpfcc
/sbin/drsnoop-bpfcc       /sbin/nodegc-bpfcc          /sbin/softirqs-bpfcc     /sbin/xfsdist-bpfcc
/sbin/execsnoop-bpfcc     /sbin/nodestat-bpfcc        /sbin/solisten-bpfcc     /sbin/xfsslower-bpfcc
/sbin/exitsnoop-bpfcc     /sbin/offcputime-bpfcc      /sbin/sslsniff-bpfcc     /sbin/zfsdist-bpfcc
/sbin/ext4dist-bpfcc      /sbin/offwaketime-bpfcc     /sbin/stackcount-bpfcc   /sbin/zfsslower-bpfcc
/sbin/ext4slower-bpfcc    /sbin/oomkill-bpfcc         /sbin/statsnoop-bpfcc
/sbin/filelife-bpfcc      /sbin/opensnoop-bpfcc       /sbin/swapin-bpfcc

Or you can pull the latest bag from the warehouse

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 4052245BD4284CDD
echo "deb https://repo.iovisor.org/apt/$(lsb_release -cs) $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/iovisor.list
sudo apt-get update
sudo apt-get install bcc-tools libbcc-examples linux-headers-$(uname -r)

Ubuntu Build from source

To build a tool chain from source code , need ：

• LLVM 3.7.1 Or later , Compile time support BPF（ Default =on）
• Clang, By and LLVM Same tree construction
• cmake (>=3.1)、gcc (>=4.7)、flex、bison
• LuaJIT, If you want Lua Support

Install dependencies

# Trusty (14.04 LTS) and older
VER=trusty
echo "deb http://llvm.org/apt/$VER/ llvm-toolchain-$VER-3.7 main deb-src http://llvm.org/apt/$VER/ llvm-toolchain-$VER-3.7 main" | \
  sudo tee /etc/apt/sources.list.d/llvm.list
wget -O - http://llvm.org/apt/llvm-snapshot.gpg.key | sudo apt-key add -
sudo apt-get update

# For Bionic (18.04 LTS)
sudo apt-get -y install bison build-essential cmake flex git libedit-dev \
  libllvm6.0 llvm-6.0-dev libclang-6.0-dev python zlib1g-dev libelf-dev libfl-dev python3-distutils

# For Eoan (19.10) or Focal (20.04.1 LTS)
sudo apt install -y bison build-essential cmake flex git libedit-dev \
  libllvm7 llvm-7-dev libclang-7-dev python zlib1g-dev libelf-dev libfl-dev python3-distutils
  
# For Hirsute (21.04) or Impish (21.10)
sudo apt install -y bison build-essential cmake flex git libedit-dev   libllvm11 llvm-11-dev libclang-11-dev python zlib1g-dev libelf-dev libfl-dev python3-distutils

# For other versions
sudo apt-get -y install bison build-essential cmake flex git libedit-dev \
  libllvm3.7 llvm-3.7-dev libclang-3.7-dev python zlib1g-dev libelf-dev python3-distutils

# For Lua support
sudo apt-get -y install luajit luajit-5.1-dev

Compile and install BCC

git clone https://github.com/iovisor/bcc.git
mkdir bcc/build; cd bcc/build
cmake ..
make
sudo make install
cmake -DPYTHON_CMD=python3 .. # build python3 binding
pushd src/python/
make
sudo make install
popd

BCC Tools

The following table lists some BCC Tools and their uses

purpose	Tool name
debugging / In many aspects	trace、argdist、funccount、stackcount、opensnoop
CPU relevant	execsnoop、runqlat、runqlen、cpudist、profile、offcputime、syscount、softirq、hardiq
Memory related	memleak
File system related	opensnoop、filelife、vfsstatt、filelower、cachestat、writeback、dcstat、xfsslower、xfsdist、ext4dist
disk IO relevant	biolatency、biosnoop、biotop、bitesize
Network related	tcpconnect、tcpaccept、tcplife、tcpretrans
Security	capable
JAVA	javastat、javacalls、javathreads、javaflow、javagc
Applications	mysqld_qslower、signals、killnoop
Kernel dependent	wakeuptime、offwaketime

Recommend a free open course of zero sound College , Personally, I think the teacher spoke well , Share with you ：

Linux,Nginx,ZeroMQ,MySQL,Redis,fastdfs,MongoDB,ZK, Streaming media ,CDN,P2P,K8S,Docker,TCP/IP, coroutines ,DPDK Etc , Learn now