You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| int64 | n/a | n/a |The nth positional parameter passed to the bpftrace program. If less than n parameters are passed this evaluates to `0`. For string arguments use the `str()` call to retrieve the value. |`$#`|
|int64| n/a | n/a |nth argument passed to the function being traced. These are extracted from the CPU registers. The amount of args passed in registers depends on the CPU architecture. (kprobes, uprobes, usdt). |`args`|
946
-
|struct args | n/a|n/a|The struct of all arguments of the traced function. Available in `tracepoint`, `fentry`, `fexit`, and `uprobe` (with DWARF) probes. Use `args.x` to access argument `x` or `args` to get a record with all arguments. | cgroup |
947
-
|uint64|4.18|get_current_cgroup_id|ID of the cgroup the current process belongs to. Only works with cgroupv2. | comm |
948
-
|string[16]|4.2|get_current_comm|Name of the current thread | cpid |
949
-
|uint32|n/a|n/a|Child process ID, if bpftrace is invoked with `-c`| cpu |
950
-
|uint32|4.1|raw_smp_processor_id|ID of the processor executing the BPF program | curtask |
951
-
|uint64|4.8|get_current_task | Pointer to `struct task_struct` of the current task | elapsed |
952
-
|uint64|(see nsec) | ktime_get_ns / ktime_get_boot_ns | Nanoseconds elapsed since bpftrace initialization, based on `nsecs`| func |
953
-
|string|n/a|n/a|Name of the current function being traced (kprobes,uprobes) | gid |
954
-
| uint64 |4.2|get_current_uid_gid|Group ID of the current thread, as seen from the init namespace | jiffies |
955
-
|uint64|5.9|get_jiffies_64|Jiffies of the kernel. In 32-bit system, using this builtin might be slower. | numaid |
956
-
| uint32 |5.8|numa_node_id| ID of the NUMA node executing the BPF program | pid |
957
-
|uint32|4.2|get_current_pid_tgid|Process ID of the current thread (aka thread group ID), as seen from the init namespace |probe|
958
-
|string|n/na|n/a|Name of the current probe | rand|
959
-
| uint32|4.1|get_prandom_u32|Random number | return |
960
-
|n/a| n/a | n/a |The return keyword is used to exit the current probe. This differs from exit() in that it doesn’t exit bpftrace. | retval |
961
-
|uint64|n/a|n/a|Value returned by the function being traced (kretprobe, uretprobe, fexit). For kretprobe and uretprobe, its type is `uint64`, but for fexit it depends. You can look up the type using `bpftrace -lv`| tid |
962
-
|uint32| 4.2 |get_current_pid_tgid|Thread ID of the current thread, as seen from the init namespace| uid |
942
+
| [`$1`, `$2`, `...$n`](#positional-parameters) | int64 | n/a | n/a | The nth positional parameter passed to the bpftrace program. If less than n parameters are passed this evaluates to `0`. For string arguments use the `str()` call to retrieve the value.
943
+
| `$#` | int64 | n/a | n/a | Total amount of positional parameters passed.
944
+
| `arg0`, `arg1`, `...argn` | int64 | n/a | n/a | nth argument passed to the function being traced. These are extracted from the CPU registers. The amount of args passed in registers depends on the CPU architecture. (kprobes, uprobes, usdt).
945
+
| `args` | struct args | n/a | n/a | The struct of all arguments of the traced function. Available in `tracepoint`, `fentry`, `fexit`, and `uprobe` (with DWARF) probes. Use `args.x` to access argument `x` or `args` to get a record with all arguments.
946
+
| cgroup | uint64 | 4.18 | get_current_cgroup_id | ID of the cgroup the current process belongs to. Only works with cgroupv2.
947
+
| comm | string[16] | 4.2 | get_current_comm | Name of the current thread
948
+
| cpid | uint32 | n/a | n/a | Child process ID, if bpftrace is invoked with `-c`
949
+
| cpu | uint32 | 4.1 | raw_smp_processor_id | ID of the processor executing the BPF program
950
+
| curtask | uint64 | 4.8 | get_current_task | Pointer to `struct task_struct` of the current task
951
+
| elapsed | uint64 | (see nsec) | ktime_get_ns / ktime_get_boot_ns | Nanoseconds elapsed since bpftrace initialization, based on `nsecs`
952
+
| func | string | n/a | n/a | Name of the current function being traced (kprobes,uprobes)
953
+
| gid | uint64 | 4.2 | get_current_uid_gid | Group ID of the current thread, as seen from the init namespace
954
+
| jiffies | uint64 | 5.9 | get_jiffies_64 | Jiffies of the kernel. In 32-bit system, using this builtin might be slower.
955
+
| numaid | uint32 | 5.8 | numa_node_id | ID of the NUMA node executing the BPF program
956
+
| pid | uint32 | 4.2 | get_current_pid_tgid | Process ID of the current thread (aka thread group ID), as seen from the init namespace
957
+
| probe | string | n/na | n/a | Name of the current probe
958
+
|rand|uint32|4.1|get_prandom_u32 | Random number|
959
+
return | n/a | n/a | n/a | The return keyword is used to exit the current probe. This differs from exit() in that it doesn’t exit bpftrace.
960
+
| retval | uint64 | n/a | n/a | Value returned by the function being traced (kretprobe, uretprobe, fexit). For kretprobe and uretprobe, its type is `uint64`, but for fexit it depends. You can look up the type using `bpftrace -lv`
961
+
| tid | uint32 | 4.2 | get_current_pid_tgid | Thread ID of the current thread, as seen from the init namespace
962
+
| uid | uint64 | 4.2 | get_current_uid_gid | User ID of the current thread, as seen from the init namespace
| [`usym(void *p)`](#usym) | Resolve user space address | Async
1086
1086
1087
1087
Functions that are marked **async** are asynchronous which can lead to unexpected behaviour, see the [Invocation Mode](#invocation-mode) section for more information.
1088
1088
@@ -1806,7 +1806,7 @@ dropped privs to tcpdump
1806
1806
The maximum string length is limited by the `BPFTRACE_MAX_STRLEN` env variable, unless `length` is specified and shorter than the maximum.
1807
1807
In case the string is longer than the specified length only `length - 1` bytes are copied and a NULL byte is appended at the end.
1808
1808
1809
-
When available (starting from kernel 5.5, see the `--info` flag) bpftrace will automatically use the `kernel` or `user` variant of `probe_read_{kernel,user}_str` based on the address space of `data`, see [Address-spaces](#Address-spaces) for more information.
1809
+
When available (starting from kernel 5.5, see the `--info` flag) bpftrace will automatically use the `kernel` or `user` variant of `probe_read_{kernel,user}_str` based on the address space of `data`, see [Address-spaces](#address-spaces) for more information.
1810
1810
1811
1811
### strcontains
1812
1812
@@ -2108,21 +2108,21 @@ Functions that are marked **async** are asynchronous which can lead to unexpecte
2108
2108
2109
2109
See [Advanced Topics](#advanced-topics) for more information on [Map Printing](#map-printing).
|Calculate the running average of `n` between consecutive calls. | Sync |[`clear(map m)`](#clear)|
2115
-
|Clear all keys/values from a map. | Async |[`count()`](#count)|
2116
-
|Count how often this function is called. | Sync |[`delete(map m, mapkey k)`](#delete)|
2117
-
|Delete a single key from a map. | Sync |[`has_key(map m, mapkey k)`](#has_key)|
2118
-
|Return true (1) if the key exists in this map. Otherwise return false (0). | Sync |[`hist(int64 n[, int k](#hist))`]|
2119
-
|Create a log2 histogram of n using buckets per power of 2, 0 <= k <= 5, defaults to 0. | Sync |[`len(map m)`](#len)|
2120
-
|Return the number of elements in a map. | Sync |[`lhist(int64 n, int64 min, int64 max, int64 step)`](#lhist)|
2121
-
|Create a linear histogram of n. lhist creates M ((max - min) / step) buckets in the range [min,max) where each bucket is step in size. | Sync |[`max(int64 n)`](#max)|
2122
-
| Update the map with n if n is bigger than the current value held. | Sync|[`min(int64 n)`](#min)|
2123
-
|Update the map with n if n is smaller than the current value held. | Sync |[`stats(int64 n)`](#stats)|
2124
-
|Combines the count, avg and sum calls into one. | Sync |[`sum(int64 n)`](#sum)|
2125
-
|Calculate the sum of all n passed. | Sync |[`zero(map m)`](#zero)|
2113
+
| [`avg(int64 n)`](#avg) | Calculate the running average of `n` between consecutive calls. | Sync
2114
+
| [`clear(map m)`](#clear) | Clear all keys/values from a map. | Async
2115
+
| [`count()`](#count) | Count how often this function is called. | Sync
2116
+
| [`delete(map m, mapkey k)`](#delete) | Delete a single key from a map. | Sync
2117
+
| [`has_key(map m, mapkey k)`](#has_key) | Return true (1) if the key exists in this map. Otherwise return false (0). | Sync
2118
+
| [`hist(int64 n[, int k])`](#hist) | Create a log2 histogram of n using buckets per power of 2, 0 <= k <= 5, defaults to 0. | Sync
2119
+
| [`len(map m)`](#len) | Return the number of elements in a map. | Sync
2120
+
| [`lhist(int64 n, int64 min, int64 max, int64 step)`](#lhist) | Create a linear histogram of n. lhist creates M ((max - min) / step) buckets in the range [min,max) where each bucket is step in size. | Sync
2121
+
| [`max(int64 n)`](#max) | Update the map with n if n is bigger than the current value held. | Sync
2122
+
| [`min(int64 n)`](#min) | Update the map with n if n is smaller than the current value held. | Sync
2123
+
| [`stats(int64 n)`](#stats) | Combines the count, avg and sum calls into one. | Sync
2124
+
| [`sum(int64 n)`](#sum) | Calculate the sum of all n passed. | Sync
2125
+
| [`zero(map m)`](#zero) | Set all values for all keys to zero. | Async
2126
2126
2127
2127
### avg
2128
2128
@@ -2504,7 +2504,7 @@ Most providers also support a short name which can be used instead of the full n
0 commit comments