Multiple process spun for each kernel probe

[the-prachi]

Hi Team - I have created one .bt file that traces tcp and udp connections by attaching to three different kernel probes. But when I check the processes using ps aux, I can see three different processes get started. Wanted to know why different bpftrace processes are getting triggered for each probe, and how can I circumvent this?

[fbs]

Can you share you ps output?

[the-prachi]

i am attaching to three probes : kretprobe:inet_csk_accept, kprobe:udp_recvmsg, kprobe:tcp_set_state in network.bt

[ajor]

The first line is for the sudo process that spawns bpftrace, but the third one is odd...

[ajor]

There should only be one bpftrace process for each command line invocation

[the-prachi]

Ok.. is this an issue with bpftrace? Or i am doing something wrong?

[danobi]

On my machine, I see:

Terminal 1:

$ sudo bpftrace -e 'BEGIN {}'
Attaching 1 probe...

$ ps aux | grep bpftrace
root       16171  0.0  0.0  21204  7896 pts/0    S+   14:16   0:00 sudo bpftrace -e BEGIN {}
root       16177  0.0  0.0  21204  2388 pts/1    Ss   14:16   0:00 sudo bpftrace -e BEGIN {}
root       16178  0.0  0.1 241640 117100 pts/1   S+   14:16   0:00 bpftrace -e BEGIN {}
dxu        17351  0.0  0.0   9664  2304 pts/3    S+   14:22   0:00 grep --color=auto bpftrace

The two sudo processes is odd. But sleep shows the same result:

$ ps aux | grep sleep
root       17371  0.0  0.0  21204  7912 pts/0    S+   14:23   0:00 sudo sleep 100000
root       17375  0.0  0.0  21204  2228 pts/1    Ss   14:23   0:00 sudo sleep 100000
root       17376  0.0  0.0   8572  1792 pts/1    S+   14:23   0:00 sleep 100000
dxu        17383  0.0  0.0   9664  2560 pts/3    S+   14:23   0:00 grep --color=auto sleep