dcsnoop(8) System Manager's Manual dcsnoop(8)
NAME
dcsnoop - Trace directory entry cache (dcache) lookups. Uses Linux
eBPF/bcc.
SYNOPSIS
dcsnoop [-h] [-a]
DESCRIPTION
By default, this traces every failed dcache lookup (cache miss), and
shows the process performing the lookup and the filename requested. A
-a option can be used to show all lookups, not just failed ones.
The output of this tool can be verbose, and is intended for further in-
vestigations of dcache performance beyond dcstat(8), which prints per-
second summaries.
This uses kernel dynamic tracing of the d_lookup() function, and will
need and will need updating to match any changes to this function.
Since this uses BPF, only the root user can use this tool.
REQUIREMENTS
CONFIG_BPF and bcc.
OPTIONS
-h Print usage message.
-a Trace references, not just failed lookups.
EXAMPLES
Trace failed dcache lookups:
# dcsnoop
Trace all dcache lookups:
# dcsnoop -a
FIELDS
TIME(s)
Time of lookup, in seconds.
PID Process ID.
COMM Process name.
T Type: R == reference (only visible with -a), M == miss. A miss
will print two lines, one for the reference, and one for the
miss.
FILE The file name component that was being looked up. This contains
trailing pathname components (after '/'), which will be the sub-
ject of subsequent lookups.
OVERHEAD
File name lookups can be frequent (depending on the workload), and this
tool prints a line for each failed lookup, and with -a, each reference
as well. The output may be verbose, and the incurred overhead, while
optimized to some extent, may still be from noticeable to significant.
This is only really intended for deeper investigations beyond dc-
stat(8), when absolutely necessary. Measure and quantify the overhead
in a test environment before use.
SOURCE
This is from bcc.
https://github.com/iovisor/bcc
Also look in the bcc distribution for a companion _examples.txt file
containing example usage, output, and commentary for this tool.
OS
Linux
STABILITY
Unstable - in development.
AUTHOR
Brendan Gregg
SEE ALSO
dcstat(1)
USER COMMANDS 2016-02-10 dcsnoop(8)
Generated by dwww version 1.16 on Tue Dec 16 05:46:54 CET 2025.