bcc-bps - Man Page

List all BPF programs. 'ps' for BPF programs.

Synopsis

bps [bpf-prog-id]

Description

bps lists all BPF programs loaded into the kernel.  It is similar to the ps command but for the BPF programs.

Each loaded bpf program is identified by an unique integer (i.e. bpf-prog-id or simply BID).  If a bpf-prog-id is specified, the maps used by bpf-prog-id will also be listed.

Examples

List all BPF programs loaded into the kernel:

bps

Show the details and maps of BID 6:

bps 6

BPF Program Fields

BID

BPF program ID.  It ends with '-' if it is not jitted.

TYPE

The type of a BPF program. e.g. kprobe, tracepoint, xdp...etc.

UID

The user ID that loaded the BPF program.

#MAPS

Total number of maps used by a BPF program.

LoadTime

When was the BPF program loaded?

NAME

The name of a BPF program.  The user space library (like bcc ) usually uses the C function name of the original BPF's source code as the program name.  It could be empty if the user space did not provide a name.

BPF Map Fields

MID

BPF map ID.

TYPE

The type of a BPF map. e.g. hash, array, stack trace...etc.

FLAGS

The flags used to create the BP map.

KeySz

The key size of a BPF map.

ValueSz

The value size of a BPF map.

MaxEnts

The maximum number of entries of a map.

NAME

The name of a BPF map.  The user space library (like bcc ) usually uses the C variable name of the BPF map as its name. It could be empty if the user space did not provide a name.

Source

This is from bcc.

https://github.com/iovisor/bcc

OS

Linux

Stability

Unstable - in development.

Author

Martin Lau

Info

2017-10-19 USER COMMANDS