bpftrace工具下载和使用（ubuntu linux）

系统和外网通

# 适用于 Ubuntu 19.04 及更高版本
sudo apt-get install -y bpftrace

系统和外网不通

sh-5.0# apt-get install bpftrace 
Reading package lists... Done Building dependency tree... Done The following additional packages will be installed: libbpfcc libclang1-9 libllvm9 The following NEW packages will be installed: bpftrace libbpfcc libclang1-9 libllvm9 0 upgraded, 4 newly installed, 0 to remove and 0 not upgraded. Need to get 30.0 MB of archives. After this operation, 140 MB of additional disk space will be used. W: Unable to read /etc/apt/preferences.d/ - DirectoryExists (2: No such file or directory) Do you want to continue? [Y/n] y 
Err:1 http://mirrors.aliyun.com/ubuntu-ports focal/universe arm64 libbpfcc arm64 0.12.0-2 Temporary failure resolving 'mirrors.aliyun.com' 
Err:2 http://mirrors.aliyun.com/ubuntu-ports focal/main arm64 libllvm9 arm64 1:9.0.1-12 Temporary failure resolving 'mirrors.aliyun.com' 
Err:3 http://mirrors.aliyun.com/ubuntu-ports focal/universe arm64 libclang1-9 arm64 1:9.0.1-12 Temporary failure resolving 'mirrors.aliyun.com' 
Err:4 http://mirrors.aliyun.com/ubuntu-ports focal/universe arm64 bpftrace arm64 0.9.4-1 Temporary failure resolving 'mirrors.aliyun.com' 
W: No sandbox user '_apt' on the system, can not drop privileges E: Failed to fetch http://mirrors.aliyun.com/ubuntu-ports/pool/universe/b/bpfcc/libbpfcc_0.12.0-2_arm64.deb Temporary failure resolving 'mirrors.aliyun.com' 
E: Failed to fetch http://mirrors.aliyun.com/ubuntu-ports/pool/main/l/llvm-toolchain-9/libllvm9_9.0.1-12_arm64.deb Temporary failure resolving 'mirrors.aliyun.com' 
E: Failed to fetch http://mirrors.aliyun.com/ubuntu-ports/pool/universe/l/llvm-toolchain-9/libclang1-9_9.0.1-12_arm64.deb Temporary failure resolving 'mirrors.aliyun.com' 
E: Failed to fetch http://mirrors.aliyun.com/ubuntu-ports/pool/universe/b/bpftrace/bpftrace_0.9.4-1_arm64.deb Temporary failure resolving 'mirrors.aliyun.com' 
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?

从报错信息中获取镜像路径手动下载：

http://mirrors.aliyun.com/ubuntu-ports/pool/universe/b/bpfcc/libbpfcc_0.12.0-2_arm64.deb

http://mirrors.aliyun.com/ubuntu-ports/pool/main/l/llvm-toolchain-9/libllvm9_9.0.1-12_arm64.deb

http://mirrors.aliyun.com/ubuntu-ports/pool/universe/l/llvm-toolchain-9/libclang1-9_9.0.1-12_arm64.deb

http://mirrors.aliyun.com/ubuntu-ports/pool/universe/b/bpftrace/bpftrace_0.9.4-1_arm64.deb

把bpftrace二进制拷贝到系统上面：

把依赖的so手动拷贝到对应库目录中即可使用。

报错解决

sh-5.0# bpftrace bt.bt 
modprobe: FATAL: Module kheaders not found in directory /lib/modules/5.10.165-rt83-v8+
Error creating printf map: Function not implemented
Creation of the required BPF maps has failed.
Make sure you have all the required permissions and are not confined (e.g. like
snapcraft does). dmesg will likely have useful output for further troubleshooting

报这些错误之后，查看内核bpftrace相关config是否使能。

CONFIG_BPF=y
CONFIG_BPF_SYSCALL=y
CONFIG_BPF_JIT=y
CONFIG_HAVE_EBPF_JIT=y
CONFIG_BPF_EVENTS=y
CONFIG_FTRACE_SYSCALLS=y
CONFIG_FUNCTION_TRACER=y
CONFIG_HAVE_DYNAMIC_FTRACE=y
CONFIG_DYNAMIC_FTRACE=y
CONFIG_HAVE_KPROBES=y
CONFIG_KPROBES=y
CONFIG_KPROBE_EVENTS=y
CONFIG_ARCH_SUPPORTS_UPROBES=y
CONFIG_UPROBES=y
CONFIG_UPROBE_EVENTS=y
CONFIG_DEBUG_FS=y

源码链接

https://github.com/bpftrace/bpftrace