使用bpf 排查 fd 泄漏

ss -s 查看 tcp close 是否很多, /proc/pid/fd

5分钟后 刷出来的堆栈 要么是长连接 要么是泄漏fd，具体可以使用 lsof 查看是否 sock 状态端口

BEGIN
{
    @start=nsecs;
}
kretprobe:__alloc_fd
/ pid==xxx/
{
    $fd = retval;
    @alloc_stack[comm, pid, $fd] = ustack;
    @allco_stack_time[comm, pid, $fd, ustack] = ((nsecs-@start)/1000)/1000;
}

kprobe:__close_fd
/ pid==xxx/
{
    $fd = arg1;
    delete(@allco_stack_time[comm, pid, $fd, @alloc_stack[comm, pid, $fd]]);
    delete(@alloc_stack[comm, pid, $fd]);
}

interval:s:600
{
    printf("####elaseped %d", ((nsecs-@start)/1000)/1000);
    print(@allco_stack_time);
    printf("\n");
}