feat: new doc

assets/jsconfig.json

@@ -3,9 +3,9 @@
   "baseUrl": ".",
   "paths": {
    "*": [
-    "../../../../.cache/hugo_cache/modules/filecache/modules/pkg/mod/wangchucheng.com/[email protected]/_vendor/github.com/FortAwesome/Font-Awesome/js-packages/@fortawesome/fontawesome-svg-core/*",
-    "../../../../.cache/hugo_cache/modules/filecache/modules/pkg/mod/wangchucheng.com/[email protected]/_vendor/github.com/FortAwesome/Font-Awesome/js-packages/@fortawesome/free-brands-svg-icons/*",
-    "../../../../.cache/hugo_cache/modules/filecache/modules/pkg/mod/wangchucheng.com/[email protected]/_vendor/github.com/FortAwesome/Font-Awesome/js-packages/@fortawesome/free-solid-svg-icons/*"
+    "../../../Library/Caches/hugo_cache/modules/filecache/modules/pkg/mod/wangchucheng.com/[email protected]/_vendor/github.com/FortAwesome/Font-Awesome/js-packages/@fortawesome/fontawesome-svg-core/*",
+    "../../../Library/Caches/hugo_cache/modules/filecache/modules/pkg/mod/wangchucheng.com/[email protected]/_vendor/github.com/FortAwesome/Font-Awesome/js-packages/@fortawesome/free-brands-svg-icons/*",
+    "../../../Library/Caches/hugo_cache/modules/filecache/modules/pkg/mod/wangchucheng.com/[email protected]/_vendor/github.com/FortAwesome/Font-Awesome/js-packages/@fortawesome/free-solid-svg-icons/*"
    ]
   }
  }

content/posts/bpf学习笔记.md

@@ -0,0 +1,73 @@
+---
+title: eBPF学习笔记
+description:
+toc: true
+authors: []
+tags: []
+categories: []
+series: []
+date: 2024-04-14T09:25:27+08:00
+lastmod: 2024-04-14T09:25:27+08:00
+featuredVideo:
+featuredImage:
+draft: false
+---
+
+eBPF的理论看起来有点抽象，实际上就是注册到内核的回调函数，可以拦截系统调用，然后用来完成自己的事情。
+
+只是这个回调函数在内核空间只能用C来写，门槛还是有点高的，除了C之外其他的语言可以写用户空间部分。
+
+tcpdump和strace等常用程序就是基于eBPF来实现的。
+
+## bcc程序集
+
+eBPF常用的利用方式是直接使用其他人贡献的bcc程序集，就和你直接用tcpdump一样。
+
+安装程序集的方法参考[这里](https://github.com/iovisor/bcc/blob/master/INSTALL.md)，Ubuntu最新版需要使用非官方PPA：
+
+```bash
+sudo add-apt-repository ppa:hadret/libbpf
+sudo add-apt-repository ppa:hadret/bpftrace
+sudo add-apt-repository ppa:hadret/bpfcc
+sudo apt-get install bpfcc-tools linux-headers-$(uname -r)
+```
+
+Ubuntu里这些二进制文件的名字会添加`-bpfbcc`的后缀，比如`exesnoop-bpfbcc`.
+
+bcc用户态的代码是用Python写的。
+
+### execsnoop
+
+监控系统新进程的产生，那些会消耗系统资源，但很短暂的进程，它们甚至不会出现在 `top` 命令或其它工具中的显示之中，此时使用该命令可以有效监控。
+
+这个名字的来源是它实际监控`exec`的系统调用。
+
+### opensnoop
+
+类似地，用来监控文件打开。
+
+### biosnoop
+
+根据块设备io，并打印延迟。
+
+一般使用biolatency -D找到延迟大的磁盘，然后使用biosnoop找到延迟大的进程。
+
+### biotop
+
+可以迅速定位占用大量io的进程。
+
+### ext4slower
+
+检测ext4系统上，文件io较慢的进程和文件名。
+
+其他文件系统也有对应的工具，修改前缀匹配即可。
+
+### biolatency
+
+块设备io延迟跟踪，以直方图显示。
+
+比iostat的输出更加直观。
+
+### cachestat
+
+查看文件系统的缓存命中率。

docs/404.html

@@ -43,7 +43,7 @@
 <link rel="stylesheet" href="https://yiuterran.github.io/blog/css/highlightjs.min.2958991528e43eb6fc9b8c4f2b8e052f79c4010718e1d1e888a777620e9ee63021c2c57ec7417a3108019bb8c41943e6.css" media="print" onload="this.media='all';this.onload=null">
 
 
-<script defer type="text/javascript" src="https://yiuterran.github.io/blog/js/fontawesome.min.949238bba008115a27fbffb62d803c5ebad5dd8516b4c6a5d9b1cc4252acf9e1a936d4e8cc1220d5a61aac817970d314.js"></script>
+<script defer type="text/javascript" src="https://yiuterran.github.io/blog/js/fontawesome.min.78e494ccd35d494929874dc88a1c7963e597460caafa2ea0b64b9f5cd2ed626a7348522a90f0b37886181ab1ed34301f.js"></script>
 
 
 <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/katex.min.css"

docs/authors/index.html

@@ -43,7 +43,7 @@
 <link rel="stylesheet" href="https://yiuterran.github.io/blog/css/highlightjs.min.2958991528e43eb6fc9b8c4f2b8e052f79c4010718e1d1e888a777620e9ee63021c2c57ec7417a3108019bb8c41943e6.css" media="print" onload="this.media='all';this.onload=null">
 
 
-<script defer type="text/javascript" src="https://yiuterran.github.io/blog/js/fontawesome.min.949238bba008115a27fbffb62d803c5ebad5dd8516b4c6a5d9b1cc4252acf9e1a936d4e8cc1220d5a61aac817970d314.js"></script>
+<script defer type="text/javascript" src="https://yiuterran.github.io/blog/js/fontawesome.min.78e494ccd35d494929874dc88a1c7963e597460caafa2ea0b64b9f5cd2ed626a7348522a90f0b37886181ab1ed34301f.js"></script>
 
 
 <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/katex.min.css"

docs/authors/index.xml

@@ -4,7 +4,7 @@
     <title>Authors on 应许之地</title>
     <link>https://yiuterran.github.io/blog/authors/</link>
     <description>Recent content in Authors on 应许之地</description>
-    <generator>Hugo -- gohugo.io</generator>
+    <generator>Hugo</generator>
     <language>zh</language>
     <copyright>&amp;copy; 2021 &lt;a href=&#34;https://github.com/YiuTerran&#34;&gt;tryao&lt;/a&gt;
 </copyright>
@@ -13,14 +13,14 @@
     <item>
       <title>个人介绍</title>
       <link>https://yiuterran.github.io/blog/authors/tryao/</link>
-      <pubDate>Tue, 09 Jan 2024 09:35:01 +0800</pubDate>
+      <pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
       <guid>https://yiuterran.github.io/blog/authors/tryao/</guid>
       <description>Self Introduction 少时曾攻经史，长成却成码农。家有懒猫伏膝侧，键盘声中迷蒙。 主业后端开发，大数据、流媒体、游戏后端之类的什么都懂一点。python/golang/j</description>
     </item>
     <item>
       <title>“Tryao&#34;</title>
       <link>https://yiuterran.github.io/blog/authors/tryao/</link>
-      <pubDate>Fri, 15 Sep 2023 14:57:05 +0800</pubDate>
+      <pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
       <guid>https://yiuterran.github.io/blog/authors/tryao/</guid>
       <description></description>
     </item>

docs/authors/tryao/index.html

@@ -43,7 +43,7 @@
 <link rel="stylesheet" href="https://yiuterran.github.io/blog/css/highlightjs.min.2958991528e43eb6fc9b8c4f2b8e052f79c4010718e1d1e888a777620e9ee63021c2c57ec7417a3108019bb8c41943e6.css" media="print" onload="this.media='all';this.onload=null">
 
 
-<script defer type="text/javascript" src="https://yiuterran.github.io/blog/js/fontawesome.min.949238bba008115a27fbffb62d803c5ebad5dd8516b4c6a5d9b1cc4252acf9e1a936d4e8cc1220d5a61aac817970d314.js"></script>
+<script defer type="text/javascript" src="https://yiuterran.github.io/blog/js/fontawesome.min.78e494ccd35d494929874dc88a1c7963e597460caafa2ea0b64b9f5cd2ed626a7348522a90f0b37886181ab1ed34301f.js"></script>
 
 
 <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/katex.min.css"

docs/authors/tryao/index.xml

@@ -4,7 +4,7 @@
     <title>个人介绍 on 应许之地</title>
     <link>https://yiuterran.github.io/blog/authors/tryao/</link>
     <description>Recent content in 个人介绍 on 应许之地</description>
-    <generator>Hugo -- gohugo.io</generator>
+    <generator>Hugo</generator>
     <language>zh</language>
     <copyright>&amp;copy; 2021 &lt;a href=&#34;https://github.com/YiuTerran&#34;&gt;tryao&lt;/a&gt;
 </copyright>

docs/authors/tryao/page/2/index.html

@@ -43,7 +43,7 @@
 <link rel="stylesheet" href="https://yiuterran.github.io/blog/css/highlightjs.min.2958991528e43eb6fc9b8c4f2b8e052f79c4010718e1d1e888a777620e9ee63021c2c57ec7417a3108019bb8c41943e6.css" media="print" onload="this.media='all';this.onload=null">
 
 
-<script defer type="text/javascript" src="https://yiuterran.github.io/blog/js/fontawesome.min.949238bba008115a27fbffb62d803c5ebad5dd8516b4c6a5d9b1cc4252acf9e1a936d4e8cc1220d5a61aac817970d314.js"></script>
+<script defer type="text/javascript" src="https://yiuterran.github.io/blog/js/fontawesome.min.78e494ccd35d494929874dc88a1c7963e597460caafa2ea0b64b9f5cd2ed626a7348522a90f0b37886181ab1ed34301f.js"></script>
 
 
 <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/katex.min.css"

docs/authors/tryao/page/3/index.html

@@ -43,7 +43,7 @@
 <link rel="stylesheet" href="https://yiuterran.github.io/blog/css/highlightjs.min.2958991528e43eb6fc9b8c4f2b8e052f79c4010718e1d1e888a777620e9ee63021c2c57ec7417a3108019bb8c41943e6.css" media="print" onload="this.media='all';this.onload=null">
 
 
-<script defer type="text/javascript" src="https://yiuterran.github.io/blog/js/fontawesome.min.949238bba008115a27fbffb62d803c5ebad5dd8516b4c6a5d9b1cc4252acf9e1a936d4e8cc1220d5a61aac817970d314.js"></script>
+<script defer type="text/javascript" src="https://yiuterran.github.io/blog/js/fontawesome.min.78e494ccd35d494929874dc88a1c7963e597460caafa2ea0b64b9f5cd2ed626a7348522a90f0b37886181ab1ed34301f.js"></script>
 
 
 <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/katex.min.css"

docs/authors/tryao/page/4/index.html

@@ -43,7 +43,7 @@
 <link rel="stylesheet" href="https://yiuterran.github.io/blog/css/highlightjs.min.2958991528e43eb6fc9b8c4f2b8e052f79c4010718e1d1e888a777620e9ee63021c2c57ec7417a3108019bb8c41943e6.css" media="print" onload="this.media='all';this.onload=null">
 
 
-<script defer type="text/javascript" src="https://yiuterran.github.io/blog/js/fontawesome.min.949238bba008115a27fbffb62d803c5ebad5dd8516b4c6a5d9b1cc4252acf9e1a936d4e8cc1220d5a61aac817970d314.js"></script>
+<script defer type="text/javascript" src="https://yiuterran.github.io/blog/js/fontawesome.min.78e494ccd35d494929874dc88a1c7963e597460caafa2ea0b64b9f5cd2ed626a7348522a90f0b37886181ab1ed34301f.js"></script>
 
 
 <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/katex.min.css"

docs/authors/tryao/page/5/index.html

@@ -43,7 +43,7 @@
 <link rel="stylesheet" href="https://yiuterran.github.io/blog/css/highlightjs.min.2958991528e43eb6fc9b8c4f2b8e052f79c4010718e1d1e888a777620e9ee63021c2c57ec7417a3108019bb8c41943e6.css" media="print" onload="this.media='all';this.onload=null">
 
 
-<script defer type="text/javascript" src="https://yiuterran.github.io/blog/js/fontawesome.min.949238bba008115a27fbffb62d803c5ebad5dd8516b4c6a5d9b1cc4252acf9e1a936d4e8cc1220d5a61aac817970d314.js"></script>
+<script defer type="text/javascript" src="https://yiuterran.github.io/blog/js/fontawesome.min.78e494ccd35d494929874dc88a1c7963e597460caafa2ea0b64b9f5cd2ed626a7348522a90f0b37886181ab1ed34301f.js"></script>
 
 
 <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/katex.min.css"

docs/categories/index.html

@@ -43,7 +43,7 @@
 <link rel="stylesheet" href="https://yiuterran.github.io/blog/css/highlightjs.min.2958991528e43eb6fc9b8c4f2b8e052f79c4010718e1d1e888a777620e9ee63021c2c57ec7417a3108019bb8c41943e6.css" media="print" onload="this.media='all';this.onload=null">
 
 
-<script defer type="text/javascript" src="https://yiuterran.github.io/blog/js/fontawesome.min.949238bba008115a27fbffb62d803c5ebad5dd8516b4c6a5d9b1cc4252acf9e1a936d4e8cc1220d5a61aac817970d314.js"></script>
+<script defer type="text/javascript" src="https://yiuterran.github.io/blog/js/fontawesome.min.78e494ccd35d494929874dc88a1c7963e597460caafa2ea0b64b9f5cd2ed626a7348522a90f0b37886181ab1ed34301f.js"></script>
 
 
 <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/katex.min.css"

docs/categories/index.xml

@@ -4,7 +4,7 @@
     <title>Categories on 应许之地</title>
     <link>https://yiuterran.github.io/blog/categories/</link>
     <description>Recent content in Categories on 应许之地</description>
-    <generator>Hugo -- gohugo.io</generator>
+    <generator>Hugo</generator>
     <language>zh</language>
     <copyright>&amp;copy; 2021 &lt;a href=&#34;https://github.com/YiuTerran&#34;&gt;tryao&lt;/a&gt;
 </copyright>
@@ -13,14 +13,14 @@
     <item>
       <title>瞎折腾</title>
       <link>https://yiuterran.github.io/blog/categories/%E7%9E%8E%E6%8A%98%E8%85%BE/</link>
-      <pubDate>Fri, 04 Mar 2022 20:54:01 +0800</pubDate>
+      <pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
       <guid>https://yiuterran.github.io/blog/categories/%E7%9E%8E%E6%8A%98%E8%85%BE/</guid>
       <description></description>
     </item>
     <item>
       <title>Work</title>
       <link>https://yiuterran.github.io/blog/categories/work/</link>
-      <pubDate>Wed, 02 Mar 2022 09:46:50 +0800</pubDate>
+      <pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
       <guid>https://yiuterran.github.io/blog/categories/work/</guid>
       <description></description>
     </item>

docs/categories/work/index.html

@@ -43,7 +43,7 @@
 <link rel="stylesheet" href="https://yiuterran.github.io/blog/css/highlightjs.min.2958991528e43eb6fc9b8c4f2b8e052f79c4010718e1d1e888a777620e9ee63021c2c57ec7417a3108019bb8c41943e6.css" media="print" onload="this.media='all';this.onload=null">
 
 
-<script defer type="text/javascript" src="https://yiuterran.github.io/blog/js/fontawesome.min.949238bba008115a27fbffb62d803c5ebad5dd8516b4c6a5d9b1cc4252acf9e1a936d4e8cc1220d5a61aac817970d314.js"></script>
+<script defer type="text/javascript" src="https://yiuterran.github.io/blog/js/fontawesome.min.78e494ccd35d494929874dc88a1c7963e597460caafa2ea0b64b9f5cd2ed626a7348522a90f0b37886181ab1ed34301f.js"></script>
 
 
 <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/katex.min.css"

docs/categories/work/index.xml

@@ -4,7 +4,7 @@
     <title>Work on 应许之地</title>
     <link>https://yiuterran.github.io/blog/categories/work/</link>
     <description>Recent content in Work on 应许之地</description>
-    <generator>Hugo -- gohugo.io</generator>
+    <generator>Hugo</generator>
     <language>zh</language>
     <copyright>&amp;copy; 2021 &lt;a href=&#34;https://github.com/YiuTerran&#34;&gt;tryao&lt;/a&gt;
 </copyright>

docs/categories/瞎折腾/index.html

@@ -43,7 +43,7 @@
 <link rel="stylesheet" href="https://yiuterran.github.io/blog/css/highlightjs.min.2958991528e43eb6fc9b8c4f2b8e052f79c4010718e1d1e888a777620e9ee63021c2c57ec7417a3108019bb8c41943e6.css" media="print" onload="this.media='all';this.onload=null">
 
 
-<script defer type="text/javascript" src="https://yiuterran.github.io/blog/js/fontawesome.min.949238bba008115a27fbffb62d803c5ebad5dd8516b4c6a5d9b1cc4252acf9e1a936d4e8cc1220d5a61aac817970d314.js"></script>
+<script defer type="text/javascript" src="https://yiuterran.github.io/blog/js/fontawesome.min.78e494ccd35d494929874dc88a1c7963e597460caafa2ea0b64b9f5cd2ed626a7348522a90f0b37886181ab1ed34301f.js"></script>
 
 
 <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/katex.min.css"

docs/categories/瞎折腾/index.xml

@@ -4,7 +4,7 @@
     <title>瞎折腾 on 应许之地</title>
     <link>https://yiuterran.github.io/blog/categories/%E7%9E%8E%E6%8A%98%E8%85%BE/</link>
     <description>Recent content in 瞎折腾 on 应许之地</description>
-    <generator>Hugo -- gohugo.io</generator>
+    <generator>Hugo</generator>
     <language>zh</language>
     <copyright>&amp;copy; 2021 &lt;a href=&#34;https://github.com/YiuTerran&#34;&gt;tryao&lt;/a&gt;
 </copyright>

docs/docs/index.html

@@ -43,7 +43,7 @@
 <link rel="stylesheet" href="https://yiuterran.github.io/blog/css/highlightjs.min.2958991528e43eb6fc9b8c4f2b8e052f79c4010718e1d1e888a777620e9ee63021c2c57ec7417a3108019bb8c41943e6.css" media="print" onload="this.media='all';this.onload=null">
 
 
-<script defer type="text/javascript" src="https://yiuterran.github.io/blog/js/fontawesome.min.949238bba008115a27fbffb62d803c5ebad5dd8516b4c6a5d9b1cc4252acf9e1a936d4e8cc1220d5a61aac817970d314.js"></script>
+<script defer type="text/javascript" src="https://yiuterran.github.io/blog/js/fontawesome.min.78e494ccd35d494929874dc88a1c7963e597460caafa2ea0b64b9f5cd2ed626a7348522a90f0b37886181ab1ed34301f.js"></script>
 
 
 <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/katex.min.css"

docs/docs/index.xml

@@ -4,7 +4,7 @@
     <title>Docs on 应许之地</title>
     <link>https://yiuterran.github.io/blog/docs/</link>
     <description>Recent content in Docs on 应许之地</description>
-    <generator>Hugo -- gohugo.io</generator>
+    <generator>Hugo</generator>
     <language>zh</language>
     <copyright>&amp;copy; 2021 &lt;a href=&#34;https://github.com/YiuTerran&#34;&gt;tryao&lt;/a&gt;
 </copyright>