syncsnoop.bt

#!/usr/bin/env bpftrace
/*
 * syncsnoop	Trace sync() variety of syscalls.
 *		For Linux, uses bpftrace and eBPF.
 *
 * Also a basic example of bpftrace.
 *
 * USAGE: syncsnoop.bt
 *
 * This is a bpftrace version of the bcc tool of the same name.
 *
 * Copyright 2018 Netflix, Inc.
 * Licensed under the Apache License, Version 2.0 (the "License")
 *
 * 06-Sep-2018	Brendan Gregg	Created this.
 */

BEGIN
{
	printf("Tracing sync syscalls... Hit Ctrl-C to end.\n");
	printf("%-9s %-6s %-16s %s\n", "TIME", "PID", "COMM", "EVENT");
}

tracepoint:syscalls:sys_enter_sync,
tracepoint:syscalls:sys_enter_syncfs,
tracepoint:syscalls:sys_enter_fsync,
tracepoint:syscalls:sys_enter_fdatasync,
tracepoint:syscalls:sys_enter_sync_file_range*,
tracepoint:syscalls:sys_enter_msync
{
	time("%H:%M:%S  ");
	printf("%-6d %-16s %s\n", pid, comm, probe);
}