Hi Lars, On Fri, 2023-07-21 at 15:45 -0700, lars@xxxxxxxxx wrote: > Hello, > > I'm using BPF to do NFS operation accounting for user-space > processes. I'd like > to include the number of bytes read and written to each file any > processes open > over NFS. > > For write operations, I'm currently using an fexit probe on the > nfs_writeback_done function, and my program appears to be getting the > information I'm hoping for. But I can see that under some > circumstances the > actual operations are being done by kworker threads, and so the PID > reported by > the BPF program is for that kworker instead of the user-space process > that > requested the write. > > Is there a more appropriate function to probe for this information if > I only > want it triggered in context of the user-space process that performed > the > write? If not, I'm wondering if there's enough information in a probe > triggered > in the kworker context to track down the user-space PID that > initiated the > writes. > > I didn't find anything related in the kernel's Documentation > directory, and I'm > not yet proficient enough with the vfs, nfs, and sunrpc code to find > an > appropriate function myself. > > If it matters, our infrastructure is all based on NFSv3. > > Thanks for any leads or documentation pointers! > Lars I tend to use the nfs:nfs_writeback_done and nfs:nfs_commit_done tracepoints. We make no attempt to track the PID that initiated the writes, because it is often impossible to do so, for instance, if the file was mmapped, or multiple processes owned by the same user are writing to the same page. If you want to track I/O at that level, I suggest rather tracing the sys_write()/sys_writev()/... system calls since those will be called from the user context. Cheers Trond -- Trond Myklebust Linux NFS client maintainer, Hammerspace trond.myklebust@xxxxxxxxxxxxxxx
