bcc-tools使用

问题一

报错

$ /usr/share/bcc/tools/opensnoop
In file included from /virtual/main.c:2:
In file included from include/uapi/linux/ptrace.h:142:
In file included from ./arch/x86/include/asm/ptrace.h:5:
./arch/x86/include/asm/segment.h:254:2: error: expected '(' after 'asm'
        alternative_io ("lsl %[seg],%[p]",
        ^
./arch/x86/include/asm/alternative.h:240:2: note: expanded from macro 'alternative_io'
        asm_inline volatile (ALTERNATIVE(oldinstr, newinstr, feature)   \
        ^
include/linux/compiler_types.h:210:24: note: expanded from macro 'asm_inline'
#define asm_inline asm __inline

按照https://github.com/iovisor/bcc/issues/2546所述，是5.4内核的修改导致bcc-tools运行失败。workaround为：
在每个脚本的C代码最上面，加上这几句

#ifdef asm_inline
#undef asm_inline
#define asm_inline asm
#endif

解决。

问题二

报错

# /usr/share/bcc/tools/bashreadline
chdir(/lib/modules/4.18.0-32.el8.x86_64/build): No such file or directory
Traceback (most recent call last):
  File "/usr/share/bcc/tools/bashreadline", line 51, in <module>
    b = BPF(text=bpf_text)
  File "/usr/lib/python3.6/site-packages/bcc/__init__.py", line 318, in __init__
    raise Exception("Failed to compile BPF text")
Exception: Failed to compile BPF text

需要安装正在运行的内核版本对应的开发包。

参考
https://access.redhat.com/solutions/3897041