NAME

       threadsnoop.bt - Trace thread creation via pthread_create(). Uses bpftrace/eBPF.

SYNOPSIS

       threadsnoop.bt

DESCRIPTION

       threadsnoop  traces  calls to pthread_create(), showing this path of thread creation. This
       can  be  used  for  workload  characterization  and  discovery,  and  is  a  companion  to
       execsnoop(8) which traces execve(2).

       This  works by tracing the pthread_create() from libpthread.so.0. The path to this library
       may need adjusting in the tool source to match your system.

       Since this uses BPF, only the root user can use this tool.

REQUIREMENTS

       CONFIG_BPF and bpftrace.

EXAMPLES

       Trace calls pthread_create():
              # threadsnoop.bt

FIELDS

       TIME(ms)
              Elapsed time since the tool began tracing (in milliseconds).

       PID    The process ID.

       COMM   The process (thread) name.

       FUNC   The name of the start routine, if the symbol is available, else a hex  address  for
              the start routine address.

OVERHEAD

       Thread  creation  is  expected  to  be  low  (<<  1000/s), so the overhead of this tool is
       expected to be negligible.

SOURCE

       This tool originated from the book "BPF Performance Tools", published  by  Addison  Wesley
       (2019):

              http://www.brendangregg.com/bpf-performance-tools-book.html

       See the book for more documentation on this tool.

       This version is in the bpftrace repository:

              https://github.com/iovisor/bpftrace

       Also  look  in  the  bpftrace  distribution  for a companion _examples.txt file containing
       example usage, output, and commentary for this tool.

OS

       Linux

STABILITY

       Unstable - in development.

AUTHOR

       Brendan Gregg

SEE ALSO

       execsnoop(8)