bpflist doesn't show attached probes

[jeromemarchand]

bpflist -vv shows no attached kprobes or uprobes

$bpflist -vv
open kprobes:

open uprobes:

PID    COMM             TYPE  COUNT
2718   biolatency       map   2
2718   biolatency       prog  2
``

I suspect this is because bpflist looks for the probes in debugfs (/sys/kernel/debug/tracing/{k,u}probe_events) and attach_kprobe uses perf_event_open() syscall when available, which is probably always nowadays.

[ZhangYet]

That's because when we attach_kprobe:

attach_kprobe(bcc/__init__.py)->bpf_attach_kprobe(src/cc/libbpf.c)->bpf_attach_probe(src/cc/libbpf.c)->bpf_try_perf_event_open_with_probe

And bpf_try_perf_event_open_with_probe won't write anything into /sys/kernel/debug/tracing/%s_events.

In fact, /sys/kernel/debug/tracing/%s_events will be written by create_probe_event if bpf_try_perf_event_open_with_probe failed. This is an old way to attach kprobe.

I wonder if we need to fix this problem.

[TrevorAmazon]

@ZhangYet I'm also noticing this behaviour with uprobes. Is there any way to get a list of probes that were attached using bpf_try_perf_event_open_with_probe?