Skip to content

Commit b8b76e9

Browse files
authored
add descriptions for using pid in attach_uprobe and attach_uretprobe. (#5367)
Add descriptions in docs/reference_guide.md for using pid in attach_uprobe and attach_uretprobe functions that allows uprobes to be attached to a specific process. The introduced contents were mainly referred by the comments of attach_probe function in bcc/src/python/bcc/__init__.py.
1 parent 3630581 commit b8b76e9

File tree

1 file changed

+7
-1
lines changed

1 file changed

+7
-1
lines changed

docs/reference_guide.md

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1709,7 +1709,7 @@ Examples in situ:
17091709

17101710
### 4. attach_uprobe()
17111711

1712-
Syntax: ```BPF.attach_uprobe(name="location", sym="symbol", fn_name="name" [, sym_off=int])```, ```BPF.attach_uprobe(name="location", sym_re="regex", fn_name="name")```, ```BPF.attach_uprobe(name="location", addr=int, fn_name="name")```
1712+
Syntax: ```BPF.attach_uprobe(name="location", sym="symbol", fn_name="name" [, sym_off=int])```, ```BPF.attach_uprobe(name="location", sym_re="regex", fn_name="name")```, ```BPF.attach_uprobe(name="location", addr=int, fn_name="name"), BPF.attach_uprobe(name="location", sym="symbol", fn_name="name", [, pid=int])```
17131713

17141714

17151715
Instruments the user-level function ```symbol()``` from either the library or binary named by ```location``` using user-level dynamic tracing of the function entry, and attach our C defined function ```name()``` to be called whenever the user-level function is called. If ```sym_off``` is given, the function is attached to the offset within the symbol.
@@ -1718,6 +1718,11 @@ The real address ```addr``` may be supplied in place of ```sym```, in which case
17181718

17191719
Instead of a symbol name, a regular expression can be provided in ```sym_re```. The uprobe will then attach to symbols that match the provided regular expression.
17201720

1721+
Uprobes can be attached to a specific process by passing `pid` to `attach_uprobe`.
1722+
By default `pid` is set to -1, indicating the `uprobe` will be attached to all processes.
1723+
For libraries, the uprobe will attach to the version of the library used by the process if `pid` was given.
1724+
For how `pid` is used, see examples in [funcinterval](https://github.com/iovisor/bcc/blob/78423e1667db202012bbb032c567589175a2796c/tools/funcinterval.py#L155-L156).
1725+
17211726
Libraries can be given in the name argument without the lib prefix, or with the full path (/usr/lib/...). Binaries can be given only with the full path (/bin/sh).
17221727

17231728
For example:
@@ -1765,6 +1770,7 @@ b.attach_uretprobe(name="/usr/bin/python", sym="main", fn_name="do_main")
17651770
```
17661771

17671772
You can call attach_uretprobe() more than once, and attach your BPF function to multiple user-level functions.
1773+
`BPF.attach_uretprobe` can also be used for a specific process.
17681774

17691775
See the previous uretprobes section for how to instrument the return value from BPF.
17701776

0 commit comments

Comments
 (0)