Re: Fwd: Any way to find the network usage by a process?

[Mike Mason]

Here's a variation of Jose's script that uses the networking tapset and 
prints top-like output for transmits and receives.  Much of the activity 
shows up under pid 0, which Jose's script filtered out.  This obviously 
doesn't reflect the actual process generating the traffic.

The networking tapset currently probes netif_receive_skb() for receives and 
dev_queue_xmit() for transmits.  Can anyone suggest better probe points to 
get transmits and receives by pid?

- Mike

Sample output:

  PID   UID DEV     XMIT_PK RECV_PK XMIT_KB RECV_KB COMMAND
    0     0 eth0        493     880      32    1238 swapper
 3078     0 eth0         26       2      28       2 Xvnc
13957     0 eth0          1       2       0       2 lspci
 3148     0 eth0          1       2       0       2 nautilus
 5058     0 eth0          1       1       0       1 firefox-bin
12277     0 eth0          1       0       0       0 sshd

nettop.stp script:

global ifxmit_p, ifrecv_p, ifxmit_b, ifrecv_b, ifdevs, ifpid, execname, user

probe netdev.transmit
{
        execname[pid()] = execname()
        user[pid()] = uid()
        ifdevs[pid(), dev_name] = dev_name
        ifxmit_p[pid(), dev_name] ++
        ifxmit_b[pid(), dev_name] += length
        ifpid[pid(), dev_name] ++
}

probe netdev.receive
{
        execname[pid()] = execname()
        user[pid()] = uid()
        ifdevs[pid(), dev_name] = dev_name
        ifrecv_p[pid(), dev_name] ++
        ifrecv_b[pid(), dev_name] += length
        ifpid[pid(), dev_name] ++
}


function print_activity()
{
        printf("%5s %5s %-7s %7s %7s %7s %7s %-15s\n",
                "PID", "UID", "DEV", "XMIT_PK", "RECV_PK", "XMIT_KB",
		"RECV_KB", "COMMAND")

        foreach ([pid,dev] in ifpid-) {
                printf("%5d %5d %-7s %7d %7d %7d %7d %-15s\n",
                        pid, user[pid], dev,
			ifxmit_p[pid, dev], ifrecv_p[pid, dev],                        		 
ifxmit_b[pid, dev]/1024,
 			ifrecv_b[pid, dev]/1024,
                        execname[pid])
        }

        print("\n")

        delete execname
        delete user
        delete ifdevs
        delete ifxmit_p
        delete ifrecv_p
        delete ifxmit_b
        delete ifrecv_b
        delete ifpid
}

probe timer.ms(5000)
{
        print_activity()
}


Jose R. Santos wrote:
> Irfan Habib wrote:
> > Hi,
> >
> > Is there any method either kernel or user level which tells me which
> > process is generating how much traffic from a machine. For example if
> > some process is flooding the network, then I would like to know which
> > process (PID ideally), is generating the most traffic.
> >
> >   
>
> A while ago I did a SystemTap script to solve a problem similar to 
> this.  It's been siting in my system for a while collecting dust and you 
> currently don't need the embedded C code since the networking.stp tapset 
> has all this script needs(and more), but I should point you in the right 
> direction.
>
> This worked a couple of months ago but it is currently untested.  Hope 
> it helps.
>
> -JRS
>
>
> global ifstats, ifdevs, execname
>
> %{
> #include<linux/skbuff.h>
> #include<linux/netdevice.h>
> %}
>
> probe kernel.function("dev_queue_xmit")
> {
>        execname[pid()] = execname()
>        name=skb_to_name($skb)
>        ifdevs[name] = name
>        ifstats[pid(),name] <<< 1
> }
>
> function skb_to_name:string (skbuff:long)
> %{
>        struct sk_buff *skbuff = (struct sk_buff *)((long)THIS->skbuff);
>        struct net_device *netdev = skbuff->dev;
>        sprintf (THIS->__retvalue, "%s" , netdev->name);
> %}
>
> probe timer.ms(5000)
> {
>        exit()
> }
>
> probe end {
>        foreach( pid in execname) {
>                if (pid == 0) continue
>                printf("%15s[%5d] ->\t", execname[pid],pid)
>                foreach( ifname in ifdevs) {
>                        printf("[%s:%7d] \t", ifname, @count(ifstats[pid, 
> ifname]))
>                }
>                print("\n")
>        }
>        print("\n")
> }
>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/