Operating Systems 2019W: Tutorial 7 - Revision history

Soma: /* Installation */

2019-03-18T20:23:16Z

Installation

← Older revision		Revision as of 20:23, 18 March 2019
Line 25:		Line 25:

	# add the bcc tools to root's path. Log out and log back in again as root to enable		# add the bcc tools to root's path. Log out and log back in again as root to enable
			# for example, type exit (to become a regular user) and then run "sudo su -"
	echo "export PATH=/usr/share/bcc/tools:\$PATH" >> /root/.profile		echo "export PATH=/usr/share/bcc/tools:\$PATH" >> /root/.profile

2019-03-18T20:18:22Z

← Older revision		Revision as of 20:18, 18 March 2019
Line 30:		Line 30:

	If you wish to install bcc-tools on a system running something other than Ubuntu 18.04, [https://github.com/iovisor/bcc/blob/master/INSTALL.md follow these directions].		If you wish to install bcc-tools on a system running something other than Ubuntu 18.04, [https://github.com/iovisor/bcc/blob/master/INSTALL.md follow these directions].

			==UNIX command review==

			Don't forget about these commands!

			* which
			* tty
			* ps aux (shows tty's for processes)

	==Tasks==		==Tasks==

2019-03-16T16:23:02Z

← Older revision		Revision as of 16:23, 16 March 2019
Line 1:		Line 1:
	~~<div style="background-color: crimson; border-style: dashed;padding-top: 10px;~~
	~~padding-right: 20px;~~
	~~padding-bottom: 10px;~~
	~~padding-left: 20px;">~~
	~~'''This tutorial is still in development.''' Please do not work on this material just yet!~~
	~~</div>~~

	In this tutorial you will be working with [https://github.com/iovisor/bcc/tree/master/tools bcc-tools], a set of tools that is part of the [https://github.com/iovisor/bcc BPF Compiler Collection (BCC)]. BCC programs are a combination of C and Python. The C code is compiled at runtime into eBPF bytecode; this code is then uploaded to the kernel and interfaced with by a Python program.		In this tutorial you will be working with [https://github.com/iovisor/bcc/tree/master/tools bcc-tools], a set of tools that is part of the [https://github.com/iovisor/bcc BPF Compiler Collection (BCC)]. BCC programs are a combination of C and Python. The C code is compiled at runtime into eBPF bytecode; this code is then uploaded to the kernel and interfaced with by a Python program.

2019-03-16T16:22:45Z

← Older revision		Revision as of 16:22, 16 March 2019
Line 92:		Line 92:
	* Get the kernel stack when intercepting calls to readline in bash.		* Get the kernel stack when intercepting calls to readline in bash.
	* Use trace to implement a version of killsnoop.		* Use trace to implement a version of killsnoop.

	~~==Tasks==~~

2019-03-16T16:22:31Z

Tools

← Older revision		Revision as of 16:22, 16 March 2019
Line 38:		Line 38:
	If you wish to install bcc-tools on a system running something other than Ubuntu 18.04, [https://github.com/iovisor/bcc/blob/master/INSTALL.md follow these directions].		If you wish to install bcc-tools on a system running something other than Ubuntu 18.04, [https://github.com/iovisor/bcc/blob/master/INSTALL.md follow these directions].

	==~~Tools~~==		==Tasks==

	You'll need root access to upload eBPF scripts to the kernel. Thus, run all of the following as root, either using "sudo" or a root shell you got via "sudo su -".		You'll need root access to upload eBPF scripts to the kernel. Thus, run all of the following as root, either using "sudo" or a root shell you got via "sudo su -".

2019-03-16T16:22:21Z

trace

← Older revision		Revision as of 16:22, 16 March 2019
Line 84:		Line 84:

	===trace===		===trace===

			<tt>trace</tt> allows you to write simple eBPF scripts on the command line.

			* Run the man page example of trace that imitates opensnoop.
			* Run the man page example of trace that imitates bashreadline.
			* Get the user stack when intercepting calls to readline in bash.
			* Get the kernel stack when intercepting calls to readline in bash.
			* Use trace to implement a version of killsnoop.

	==Tasks==		==Tasks==

2019-03-16T16:09:17Z

syscount

← Older revision		Revision as of 16:09, 16 March 2019
Line 74:		Line 74:

	===syscount===		===syscount===

			<tt>syscount</tt> counts system calls
			* What are the frequent system calls when the system is idle (you aren't doing anything on the command line)?
			* What programs are generating the most system calls?
			* What system calls are slow (have high latency)?
			* Are there many system calls failing?

			Note that you may want to connect to your VM using x2go for this part as then you'll have a desktop's worth of processes to observe.

	===trace===		===trace===

	==Tasks==		==Tasks==

2019-03-16T16:03:11Z

killsnoop

← Older revision		Revision as of 16:03, 16 March 2019
Line 66:		Line 66:

	===killsnoop===		===killsnoop===

			<tt>killsnoop</tt> reports on calls to the kill system call.
			* Send a process a signal using "kill". Try sending the TERM, STOP, and KILL signals. Are these all picked up by killsnoop?
			* Type Ctrl-C at the command line. Note that sometimes it generates a signal, sometimes it doesn't. What happens when your own program gets Ctrl-C? Can you change whether or not typing Ctrl-C generates a signal?
			* Put a process into the background using Ctrl-Z and bring it back to the foreground using fg. Were there any calls to kill?
			* strace a process. Do you see any kill system calls?

	===syscount===		===syscount===

2019-03-16T13:53:52Z

ttysnoop

← Older revision		Revision as of 13:53, 16 March 2019
Line 61:		Line 61:
	<tt>ttysnoop</tt> allows you to observe what is being entered on other tty's.		<tt>ttysnoop</tt> allows you to observe what is being entered on other tty's.

			* How do you figure out the tty associated with another ssh connection or window? How can you find out all of the pseudo tty's that have been allocated on the system?
			* Notice how the output of some programs (e.g., top) are truncated. Looking at the code of ttysnoop and doing an strace of the program, can you figure out why output is being truncated?
			* Can you (easily) reduce or eliminate the truncation? Why or why not?

	===killsnoop===		===killsnoop===

2019-03-16T13:47:06Z

Tools

← Older revision		Revision as of 13:47, 16 March 2019
Line 51:		Line 51:

	===bashreadline===		===bashreadline===

			<tt>bashreadline</tt> lets you see what commands are typed in to bash on any process on the system. It does so by intercepting calls to readline.

			* Run "bashreadline" and observe the commands that are entered in other terminals (you'll have to have multiple shells running on your VM).
			* Can you trivially modify bashreadline to observe what is entered in other programs that use readline, such as bc and gdb? You may need to specify the location of the readline shared library (remember ldd!).

	===ttysnoop===		===ttysnoop===

			<tt>ttysnoop</tt> allows you to observe what is being entered on other tty's.



	===killsnoop===		===killsnoop===