CODEWITHSUNDEEP
c++tracebpfebpf
Brad Walker
Brad Walker

Reputation: 51

Attach bpftrace probe to C++ function

I have a question about bpftrace syntax and hoping that someone might have seen this before.

In looking at the bpftrace reference document, I've been able to trace a user-app function successfully. No problems there. What I can't figure out is how to attach a probe to a C++ method.

For example, here is the syntax that I'm using and the error:

$ bpftrace -e 'uretprobe:/usr/share/BigApp:BigApp::MethodName { printf("method return\n"); }'
1.34-35: syntax error, unexpected path, expecting {

What would be the proper syntax for attaching a bpftrace probe to a C++ user-app?

Upvotes: 2

Views: 2227

Answers (2)

alan ng
alan ng

Reputation: 31

bpftrace currently support probe c++ name without demangle, like

uprobe:executable:"function signature" {
   //...
}

see https://github.com/caringi/bpftrace/commit/e28ad2ca4276e1433e293dcc0346545fc316fae5

Upvotes: 3

koxt
koxt

Reputation: 693

main.cpp

#include <iostream>

class BigApp {
  public:
    void methodName() {
      std::cout << "method Name!";
    }
};

int main() {
  BigApp bigApp;      
  bigApp.methodName();      
  return 0;
}

g++ main.cpp -o main

# locate mangled symbol name
readelf -Ws /home/koxt/dev/cpp/main | grep methodName
69: 00000000004007ee    30 FUNC    WEAK   DEFAULT   14 _ZN6BigApp10methodNameEv

bpftrace -e 'uprobe:/home/koxt/dev/cpp/main:_ZN6BigApp10methodNameEv { printf("1"); }'

Upvotes: 4

Related Questions