{"action":"created","issue":{"url":"https://api.github.com/repos/iovisor/bcc/issues/748","repository_url":"https://api.github.com/repos/iovisor/bcc","labels_url":"https://api.github.com/repos/iovisor/bcc/issues/748/labels{/name}","comments_url":"https://api.github.com/repos/iovisor/bcc/issues/748/comments","events_url":"https://api.github.com/repos/iovisor/bcc/issues/748/events","html_url":"https://github.com/iovisor/bcc/issues/748","id":182900287,"number":748,"title":"Can't use syscall tracepoints","user":{"login":"brendangregg","id":1101211,"avatar_url":"https://avatars0.githubusercontent.com/u/1101211?v=3","gravatar_id":"","url":"https://api.github.com/users/brendangregg","html_url":"https://github.com/brendangregg","followers_url":"https://api.github.com/users/brendangregg/followers","following_url":"https://api.github.com/users/brendangregg/following{/other_user}","gists_url":"https://api.github.com/users/brendangregg/gists{/gist_id}","starred_url":"https://api.github.com/users/brendangregg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brendangregg/subscriptions","organizations_url":"https://api.github.com/users/brendangregg/orgs","repos_url":"https://api.github.com/users/brendangregg/repos","events_url":"https://api.github.com/users/brendangregg/events{/privacy}","received_events_url":"https://api.github.com/users/brendangregg/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":23,"created_at":"2016-10-13T21:03:01Z","updated_at":"2017-06-27T20:43:34Z","closed_at":null,"body":"```\n # ./tools/trace.py t:syscalls:sys_enter_newfstat\nIoctl(PERF_EVENT_IOC_SET_BPF): Invalid argument\nFailed to attach BPF to tracepoint\n```\n\nHere's newfstat.py:\n\n``` Python\n#!/usr/bin/python\n\nfrom __future__ import print_function\nfrom bcc import BPF\n\n# load BPF program\nb = BPF(text=\"\"\"\nTRACEPOINT_PROBE(syscalls, sys_enter_newfstat) {\n    bpf_trace_printk(\"%d\\\\n\", args->fd);\n    return 0;\n};\n\"\"\", debug=0)\n\n# header\nprint(\"%-18s %-16s %-6s %s\" % (\"TIME(s)\", \"COMM\", \"PID\", \"FD\"))\n\n# format output\nwhile 1:\n    try:\n        (task, pid, cpu, flags, ts, msg) = b.trace_fields()\n    except ValueError:\n        continue\n    print(\"%-18.9f %-16s %-6d %s\" % (ts, task, pid, msg))\n```\n\noutput:\n\n```\n# ./newfstat.py \nioctl(PERF_EVENT_IOC_SET_BPF): Invalid argument\nTraceback (most recent call last):\n  File \"./newfstat.py\", line 12, in <module>\n    \"\"\", debug=0)\n  File \"/usr/lib/python2.7/dist-packages/bcc/__init__.py\", line 212, in __init__\n    self._trace_autoload()\n  File \"/usr/lib/python2.7/dist-packages/bcc/__init__.py\", line 767, in _trace_autoload\n    self.attach_tracepoint(tp=tp, fn_name=fn.name)\n  File \"/usr/lib/python2.7/dist-packages/bcc/__init__.py\", line 585, in attach_tracepoint\n    raise Exception(\"Failed to attach BPF to tracepoint\")\nException: Failed to attach BPF to tracepoint\n```\n\nTesting on 4.8-rc4. Same problem with other syscall tracepoints.\n\nI can use kprobes as a workaround in the meantime, but this should be a nice example of using tracepoints...\n"},"comment":{"url":"https://api.github.com/repos/iovisor/bcc/issues/comments/311479516","html_url":"https://github.com/iovisor/bcc/issues/748#issuecomment-311479516","issue_url":"https://api.github.com/repos/iovisor/bcc/issues/748","id":311479516,"user":{"login":"brendangregg","id":1101211,"avatar_url":"https://avatars0.githubusercontent.com/u/1101211?v=3","gravatar_id":"","url":"https://api.github.com/users/brendangregg","html_url":"https://github.com/brendangregg","followers_url":"https://api.github.com/users/brendangregg/followers","following_url":"https://api.github.com/users/brendangregg/following{/other_user}","gists_url":"https://api.github.com/users/brendangregg/gists{/gist_id}","starred_url":"https://api.github.com/users/brendangregg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brendangregg/subscriptions","organizations_url":"https://api.github.com/users/brendangregg/orgs","repos_url":"https://api.github.com/users/brendangregg/repos","events_url":"https://api.github.com/users/brendangregg/events{/privacy}","received_events_url":"https://api.github.com/users/brendangregg/received_events","type":"User","site_admin":false},"created_at":"2017-06-27T20:43:34Z","updated_at":"2017-06-27T20:43:34Z","body":"Does it need a newer kernel, or does trace.py need updating? Just tried it quickly on 4.9.0-rc5:\r\n\r\n```\r\n# ./trace.py t:syscalls:sys_enter_newfstat\r\nIn file included from /virtual/main.c:5:\r\n/lib/modules/4.9.0-rc5-virtual/build/include/linux/fs.h:2693:9: warning: comparison of unsigned enum expression < 0 is always false [-Wtautological-compare]\r\n        if (id < 0 || id >= READING_MAX_ID)\r\n            ~~ ^ ~\r\n1 warning generated.\r\nioctl(PERF_EVENT_IOC_SET_BPF): Invalid argument\r\nFailed to attach BPF to tracepoint\r\n```"}}
{"actor":{"display_login":"brendangregg"}}