tutorials/bpftrace-tutorial/

[giscus[bot]]

tutorials/bpftrace-tutorial/

Unlock the potential of eBPF

https://eunomia.dev/tutorials/bpftrace-tutorial/

[yshdzw]

In the lesson 3, using arg-> works fine.

root@vm:/data# uname -a
Linux vm 5.4.0-211-generic #231-Ubuntu SMP Tue Mar 11 17:06:58 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
root@vm:/data# cat /etc/os-release 
NAME="Ubuntu"
VERSION="20.04.6 LTS (Focal Fossa)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 20.04.6 LTS"
VERSION_ID="20.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=focal
UBUNTU_CODENAME=focal
root@vm:/data# bpftrace --version
bpftrace v0.9.4
root@vm:/data# bpftrace -e 'tracepoint:syscalls:sys_enter_openat { printf("%s %s\n", comm, str(args.filename)); }'
stdin:1:64-73: ERROR: Can not access field 'filename' on type 'struct _tracepoint_syscalls_sys_enter_openat'. Try dereferencing it first, or using '->'
tracepoint:syscalls:sys_enter_openat { printf("%s %s\n", comm, str(args.filename)); }
                                                               ~~~~~~~~~
root@vm:/data# bpftrace -e 'tracepoint:syscalls:sys_enter_openat { printf("%s %s\n", comm, str(args->filename)); }'
Attaching 1 probe...
node /proc/2561/cmdline
node /proc/2917/cmdline
node /proc/139369/cmdline
node /proc/234266/cmdline
node /root/.vscode-server/data/User/workspaceStorage/83d914b33f09508
node /proc/2561/cmdline
node /proc/2917/cmdline
node /proc/139369/cmdline
node /proc/234266/cmdline
^C