BCC工具命令报错解决步骤

使用BCC工具报错

[root@server02 ~]# /usr/share/bcc/tools/execsnoop
modprobe: FATAL: Module kheaders not found in directory /lib/modules/5.10.0-60.18.0.50.r1083_58.hce2.x86_64
Unable to find kernel headers. Try rebuilding kernel with CONFIG_IKHEADERS=m (module) or installing the kernel development package for your running kernel version.
chdir(/lib/modules/5.10.0-60.18.0.50.r1083_58.hce2.x86_64/build): No such file or directory
Traceback (most recent call last):
  File "/usr/share/bcc/tools/execsnoop", line 227, in <module>
    b = BPF(text=bpf_text)
  File "/usr/lib/python3.9/site-packages/bpfcc/__init__.py", line 479, in __init__
    raise Exception("Failed to compile BPF module %s" % (src_file or "<text>"))
Exception: Failed to compile BPF module <text>

经过确认，此类报错一般就是需要更新内核模块

内核升级

[root@server02 ~]# yum -y install kernel-headers
Last metadata expiration check: 0:51:49 ago on Mon 15 Jul 2024 03:42:51 PM CST.
Package kernel-headers-5.10.0-182.0.0.95.r1941_123.hce2.x86_64 is already installed.
Dependencies resolved.
Nothing to do.
Complete!
[root@server02 ~]# yum -y install kernel-devel-$(uname -r)
Last metadata expiration check: 0:52:06 ago on Mon 15 Jul 2024 03:42:51 PM CST.
Dependencies resolved.
===============================================================================================================================================================================================================================================================================================================================
 Package                                                                     Architecture                                                          Version                                                                                        Repository                                                              Size
===============================================================================================================================================================================================================================================================================================================================
Downgrading:
 kernel-devel                                                                x86_64                                                                5.10.0-60.18.0.50.r1083_58.hce2                                                                updates                                                                 17 M

Transaction Summary
===============================================================================================================================================================================================================================================================================================================================
Downgrade  1 Package

Total download size: 17 M
Downloading Packages:
kernel-devel-5.10.0-60.18.0.50.r1083_58.hce2.x86_64.rpm  

验证

执行opensnoop命令，已经可以顺利使用

[root@server02 ~]# /usr/share/bcc/tools/opensnoop
PID    COMM               FD ERR PATH
775    hostwatch           5   0 /proc/775/stat
775    hostwatch           5   0 /proc/804/stat
775    hostwatch           5   0 /usr/local/hostguard/run/heartbeat.tick
775    hostwatch           5   0 /proc/1659/stat
775    hostwatch           5   0 /sys/devices/system/cpu/online
775    hostwatch           5   0 /usr/local/hostguard/run/restart.conf
775    hostwatch           5   0 /proc/meminfo
670    irqbalance          7   0 /proc/irq/affinity_hint_notify
670    irqbalance          7   0 /proc/irq/affinity_hint_notify
775    hostwatch           5   0 /proc/775/stat
775    hostwatch           5   0 /proc/804/stat
775    hostwatch           5   0 /usr/local/hostguard/run/heartbeat.tick
775    hostwatch           5   0 /proc/1659/stat
775    hostwatch           5   0 /sys/devices/system/cpu/online
775    hostwatch           5   0 /usr/local/hostguard/run/restart.conf
775    hostwatch           5   0 /proc/meminfo

配置环境变量

为保证可以更方便使用bcc命令，将对应路径加入/etc/profile文件内。

echo "export PATH='/usr/local/bcc/tools:$PATH'" >> /etc/profile