From: Mike Mason <mmlnx@us.ibm.com>
To: jrs@us.ibm.com
Cc: Irfan Habib <irfan.habib@gmail.com>,
Linux kernel <linux-kernel@vger.kernel.org>,
SystemTAP <systemtap@sources.redhat.com>
Subject: Re: Fwd: Any way to find the network usage by a process?
Date: Wed, 04 Oct 2006 20:54:00 -0000 [thread overview]
Message-ID: <45241F7A.5050501@us.ibm.com> (raw)
In-Reply-To: <452285FD.7010909@us.ibm.com>
Here's a variation of Jose's script that uses the networking tapset and
prints top-like output for transmits and receives. Much of the activity
shows up under pid 0, which Jose's script filtered out. This obviously
doesn't reflect the actual process generating the traffic.
The networking tapset currently probes netif_receive_skb() for receives and
dev_queue_xmit() for transmits. Can anyone suggest better probe points to
get transmits and receives by pid?
- Mike
Sample output:
PID UID DEV XMIT_PK RECV_PK XMIT_KB RECV_KB COMMAND
0 0 eth0 493 880 32 1238 swapper
3078 0 eth0 26 2 28 2 Xvnc
13957 0 eth0 1 2 0 2 lspci
3148 0 eth0 1 2 0 2 nautilus
5058 0 eth0 1 1 0 1 firefox-bin
12277 0 eth0 1 0 0 0 sshd
nettop.stp script:
global ifxmit_p, ifrecv_p, ifxmit_b, ifrecv_b, ifdevs, ifpid, execname, user
probe netdev.transmit
{
execname[pid()] = execname()
user[pid()] = uid()
ifdevs[pid(), dev_name] = dev_name
ifxmit_p[pid(), dev_name] ++
ifxmit_b[pid(), dev_name] += length
ifpid[pid(), dev_name] ++
}
probe netdev.receive
{
execname[pid()] = execname()
user[pid()] = uid()
ifdevs[pid(), dev_name] = dev_name
ifrecv_p[pid(), dev_name] ++
ifrecv_b[pid(), dev_name] += length
ifpid[pid(), dev_name] ++
}
function print_activity()
{
printf("%5s %5s %-7s %7s %7s %7s %7s %-15s\n",
"PID", "UID", "DEV", "XMIT_PK", "RECV_PK", "XMIT_KB",
"RECV_KB", "COMMAND")
foreach ([pid,dev] in ifpid-) {
printf("%5d %5d %-7s %7d %7d %7d %7d %-15s\n",
pid, user[pid], dev,
ifxmit_p[pid, dev], ifrecv_p[pid, dev],
ifxmit_b[pid, dev]/1024,
ifrecv_b[pid, dev]/1024,
execname[pid])
}
print("\n")
delete execname
delete user
delete ifdevs
delete ifxmit_p
delete ifrecv_p
delete ifxmit_b
delete ifrecv_b
delete ifpid
}
probe timer.ms(5000)
{
print_activity()
}
Jose R. Santos wrote:
> Irfan Habib wrote:
>> Hi,
>>
>> Is there any method either kernel or user level which tells me which
>> process is generating how much traffic from a machine. For example if
>> some process is flooding the network, then I would like to know which
>> process (PID ideally), is generating the most traffic.
>>
>>
>
> A while ago I did a SystemTap script to solve a problem similar to
> this. It's been siting in my system for a while collecting dust and you
> currently don't need the embedded C code since the networking.stp tapset
> has all this script needs(and more), but I should point you in the right
> direction.
>
> This worked a couple of months ago but it is currently untested. Hope
> it helps.
>
> -JRS
>
>
> global ifstats, ifdevs, execname
>
> %{
> #include<linux/skbuff.h>
> #include<linux/netdevice.h>
> %}
>
> probe kernel.function("dev_queue_xmit")
> {
> execname[pid()] = execname()
> name=skb_to_name($skb)
> ifdevs[name] = name
> ifstats[pid(),name] <<< 1
> }
>
> function skb_to_name:string (skbuff:long)
> %{
> struct sk_buff *skbuff = (struct sk_buff *)((long)THIS->skbuff);
> struct net_device *netdev = skbuff->dev;
> sprintf (THIS->__retvalue, "%s" , netdev->name);
> %}
>
> probe timer.ms(5000)
> {
> exit()
> }
>
> probe end {
> foreach( pid in execname) {
> if (pid == 0) continue
> printf("%15s[%5d] ->\t", execname[pid],pid)
> foreach( ifname in ifdevs) {
> printf("[%s:%7d] \t", ifname, @count(ifstats[pid,
> ifname]))
> }
> print("\n")
> }
> print("\n")
> }
>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
>
next prev parent reply other threads:[~2006-10-04 20:54 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <3420082f0610030114o5b44b8ak7797483e02002614@mail.gmail.com>
[not found] ` <3420082f0610030114o4c6998en907bccce81d28c59@mail.gmail.com>
2006-10-03 15:49 ` Jose R. Santos
2006-10-04 20:54 ` Mike Mason [this message]
2006-10-05 21:22 ` Frank Ch. Eigler
2006-10-05 23:28 ` Mike Mason
2006-10-06 0:00 ` Frank Ch. Eigler
2006-10-06 1:10 ` Mike Mason
2006-10-06 15:30 ` Frank Ch. Eigler
2006-10-06 1:08 Stone, Joshua I
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=45241F7A.5050501@us.ibm.com \
--to=mmlnx@us.ibm.com \
--cc=irfan.habib@gmail.com \
--cc=jrs@us.ibm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=systemtap@sources.redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).