0xtools

This is still a beta / tech-nerd preview release. Please don't run it in busy production environments yet.

The main noteworthy change is that now there's a -o option to switch xcapture-bpf to always-on CSV output mode.

./xcapture-bpf -o /some/dirname

This will make xcapture log the 1HZ samples into hourly threads_* files in the output directory and if the stack capture is enabled (its enabled by default in -o mode), it will write any newly seen stack traces into a stacks_* file.

Unlike the hourly files with 1HZ thread sample history, a single stack file is created at xcapture startup (with a startup timestamp in it) and it appends newly seen, not yet written stacks into the end of the single file.

This is likely the final release of the BCC-based beta / developer preview. I've hit too many limitations sooner than I had thought and will now focus on writing a proper final version of this tool (that I can be proud of!) using libbpf and a better frontend. Use the current v2 release for testing and exploring what's possible!

Full Changelog: https://github.com/tanelpoder/0xtools/compare/v2.0.2...v2.0.3

First major release of the next xcapture-bpf beta tool.
Updates and fixes for the classic 0x.tools, psn, xcapture (/proc).

What's Changed

Lots!

New Contributors

• @skoehler-soocs made their first contribution in https://github.com/tanelpoder/0xtools/pull/39

Full Changelog: https://github.com/tanelpoder/0xtools/compare/v1.2.4...v2.0.2

Fixed a bug where wrong system call names were shown on some versions/platforms (due to looking up wrong unistd.h file)

Full Changelog: https://github.com/tanelpoder/0xtools/compare/v1.2.3...v1.2.4

• Supports arm64 and ppc64le platforms (unistd.h lookup for syscall names)

• Added more "single file descriptor" system calls to psn (for reporting the accessed file name)

• xcapture supports basic container namespace reporting (use -c nspid or -o output_dir as CSV output reports NSPID by default)

• psn with python3 now prints extra newlines in output as intended

• added a rudimentary tool vmtop for showing snapshots of /proc/vmstat activity

• also added rpmbuild files, but it's not working well yet, as rpmbuild seems to want to use a hard-coded python binary name instead of /usr/bin/env python (will look into this before next release)

What's Changed

• Add unistd.h path of CentOS7 ppc64le release by @xcnix in https://github.com/tanelpoder/0xtools/pull/28
• add few syscalls to report dir as filename by @timurakhmadeev in https://github.com/tanelpoder/0xtools/pull/17
• Support systemd and rpmbuild by @hungrybirder in https://github.com/tanelpoder/0xtools/pull/29

New Contributors

• @xcnix made their first contribution in https://github.com/tanelpoder/0xtools/pull/28
• @timurakhmadeev made their first contribution in https://github.com/tanelpoder/0xtools/pull/17
• @hungrybirder made their first contribution in https://github.com/tanelpoder/0xtools/pull/29

Full Changelog: https://github.com/tanelpoder/0xtools/compare/v1.1.3...v1.2.3

Changed make uninstall to use rm rf for removing a python lib dir

Fixed a make install issue caused by another fix in v1.1.1 (need automated test flow!)

Fixed a python path issue so that pSnapper works both from an installed location (/usr/bin) or from within the source tarball directory.

• Python3 support for psn
• Changed license from GPL 3.0 to GPL 2.0 or higher
• xcapture can do more frequent sampling now (sleep <1s)
• Using semantic versioning now
• Accepted first PR from other people (thanks @lefred , @tcdale @ckujau)