bpftrace not working on centos 7

[the-prachi]

Hi Team - I was trying to run bpftrace v0.20.0 in centos7 and getting below error:
[stderr]
definitions.h:3:10: fatal error: 'net/tcp_states.h' file not found

Could you suggest what could be the issue?

[jordalgo]

@the-prachi Do you have the script you were trying to run?

[the-prachi]

Yes. I was running both of these:
https://github.com/bpftrace/bpftrace/blob/master/tools/tcpconnect.bt
https://github.com/bpftrace/bpftrace/blob/master/tools/tcpaccept.bt

[jordalgo]

Cool. I'll take a look. Just out of curiosity, can you run other bpftrace scripts without error or even the basic hello world (e.g. sudo bpftrace -e 'BEGIN { print(("Hello World")); exit(); }' ?

[the-prachi]

So i ran the helloworld script as above and got following error:
Enable succeeded:
[stdout]
Attaching 1 probe...

[stderr]
ERROR: failed to create map: Permission denied
Creation of the required BPF maps has failed.
Make sure you have all the required permissions and are not confined (e.g. like
snapcraft does). dmesg will likely have useful output for further troubleshooting

I don't have admin priviledges on this VM so can't do sudo. But not sure, if its related to that.

[jordalgo]

Ah, yes, you need sudo to run bpftrace. This is a hard requirement (for now).

[the-prachi]

Ok. but the TCP scripts were fired with root users. I don't have explicit root privilege to this VM to run additional scripts.

[ajor]

It sounds like there's a missing header on your machine. Have you got your kernel headers installed? (although I don't think tcp_states.h is part of mine...)

The two scripts both include headers in this snippet:

#ifndef BPFTRACE_HAVE_BTF
#include <linux/socket.h>
#include <net/sock.h>
#else
#include <sys/socket.h>
#endif

I don't know why or which of these headers would be requesting net/tcp_states.h, but the first thing to check is whether BPFTRACE_HAVE_BTF is true or false. I think sudo bpftrace --info 2>&1 | grep btf will tell you.

Once you know which root header is the problem, we'll need to understand if it's a problem with bpftrace or with your system: if you try including these headers in a C program, does it compile or error out with a similar message?

[the-prachi]

Enable succeeded:
[stdout]
btf: yes
module btf: yes

[stderr]